Foundations Review — Framing a Product
What is it?
A review of Module 1 — the data/information/intelligence ladder, the three levels, actionability, consumers, and the analyst mindset — assembled into the decisions you make before writing any CTI product.
Why it matters
Framing a product correctly — level, audience, action — before writing it is what separates intelligence from a wall of facts.
Where you see it
The first decisions of every CTI product.
What normal looks like
A product framed with a level, a named consumer, an assessment with confidence, and a recommended action.
What suspicious looks like
Not applicable at review level.
How analysts investigate
By deciding the level and audience first, then producing an assessed, actionable product for exactly that decision.
Common beginner mistakes
- Starting to write before deciding who it is for and what decision it supports — the product then serves no one.
Frame Sahab's first product from a raw fact: a lookalike domain targeting staff. Decide the level (tactical/operational), the consumer (SOC + staff comms), the assessment with confidence, and the action.
Quick check
Which is the best-framed CTI product for the lookalike-domain finding?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.