CTI Hyperloop Framework

The CTI Hyperloop (based on Google/Mandiant's practical implementation framework) extends the traditional intelligence cycle by running it at three levels simultaneously with continuous bidirectional feedback.

Core Concept

Traditional intelligence cycle: linear, single-track, often stuck at the tactical level. Hyperloop: three parallel tracks (strategic, operational, tactical) feeding each other continuously.

STRATEGIC  ←→  OPERATIONAL  ←→  TACTICAL
    ↓              ↓               ↓
Direction → Collection → Processing → Analysis → Dissemination → Feedback
    ↑                                                              |
    └──────────────────────────────────────────────────────────────┘

Intelligence Levels

Strategic Intelligence

• Time horizon: 6-24 months
• Consumers: CISO, Board, Risk Management, Security Architecture
• Focus: Threat landscape trends, emerging threats, geopolitical developments, sector risk posture
• Products: Threat landscape reports, strategic assessments, horizon scanning reports, maturity assessments
• Example PIR: "How will the ransomware threat landscape evolve over the next 12 months and what are the implications for our risk posture?"

Operational Intelligence

• Time horizon: Weeks to months
• Consumers: SOC Manager, IR Lead, Security Operations
• Focus: Active campaigns, threat actor profiling, TTP analysis, vulnerability exploitation trends
• Products: Campaign reports, threat actor profiles, operational assessments, hunt packages
• Example PIR: "What TTPs are currently being used by groups targeting our sector?"

Tactical Intelligence

• Time horizon: Hours to days
• Consumers: SOC Analysts, Detection Engineers, IR Analysts
• Focus: IOCs, detection rules, immediate response support, indicator enrichment
• Products: IOC packages, SIGMA/YARA/KQL rules, flash reports, enrichment reports
• Example PIR: "What IOCs are associated with the current wave of attacks targeting our VPN appliances?"

Phase Mapping to Platform

Phase 1: Planning & Direction

What: Define what intelligence is needed and set priorities.

Phase 2: Collection

What: Gather raw data from relevant sources.

Phase 3: Processing

What: Normalise, deduplicate, and structure collected data.

Phase 4: Analysis

What: Apply human judgment to produce assessed intelligence.

Phase 5: Dissemination

What: Deliver finished intelligence to stakeholders.

Phase 6: Feedback

What: Assess effectiveness and refine direction.

Bidirectional Flow Examples

Tactical → Operational: IOC enrichment reveals infrastructure pattern shared across multiple incidents → triggers campaign tracking investigation.

Operational → Strategic: Campaign analysis identifies new nation-state actor shifting targeting to a new sector → feeds into strategic landscape assessment and PIR update.

Strategic → Operational: Horizon scanning identifies AI-augmented social engineering as emerging threat → creates operational collection tasking for specific TTP monitoring.

Operational → Tactical: Threat actor profiling reveals preferred exploitation technique → drives creation of specific SIGMA detection rules.

Strategic → Tactical: Risk assessment identifies unpatched VPN as critical exposure → prioritises vulnerability intelligence and IOC monitoring for VPN exploits.

Tactical → Strategic: Spike in credential-stuffing alerts → informs strategic assessment of the underground economy and infostealer trend.

Orchestrator Workflow Mapping

When the orchestrator receives a task, it maps it to the Hyperloop: