Who Consumes CTI
What is it?
CTI has many internal customers: the SOC (detection content), incident responders (context during a case), threat hunters (hypotheses), vulnerability management (prioritization), and leadership (risk decisions). Knowing your consumers shapes what you collect and how you deliver it.
Why it matters
CTI does not exist for itself; it is a service to other functions. An analyst who does not know their customers produces intelligence no one asked for.
Where you see it
The distribution list and the intelligence requirements of each consumer.
What normal looks like
Products tailored to a named consumer's decisions — detections for the SOC, hypotheses for hunters.
What suspicious looks like
Not applicable directly.
How analysts investigate
By mapping each product to the consumer whose decision it supports, and collecting to serve those consumers' requirements.
Common beginner mistakes
- Producing intelligence in a vacuum with no consumer in mind — it may be excellent and still change nothing because no one needed it.
Sahab's CTI feeds four teams differently: the SOC gets detection-ready IOCs and TTPs, the hunt team gets prioritized hypotheses, IR gets actor context mid-incident, and the board gets quarterly strategic assessments. Same team, four products, four decisions.
Quick check
The threat hunting team asks CTI for support. What is the most useful CTI product for them?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.