CTI Report Writing 101: How to Effectively Communicate Threat Intelligence

Cyber threat intelligence (CTI) reports are essential for every organization. They allow you to assess emerging threats, prioritize resources, and proactively defend yourself. As a cyber security professional, you must know how to write one and be proficient in CTI report writing.

This guide will teach you how to write a CTI report, what you must include, and showcase a simple writing process you can follow so you don’t get stuck with writer’s block. It will also highlight best practices for CTI report writing, enabling you to start producing high-quality threat intelligence reports today!

Let’s begin by understanding the importance of CTI report writing and the benefits that good threat reports can bring to an organization.

---

Why Is CTI Report Writing Important?

A cyber threat intelligence (CTI) report provides insights into current and emerging cyber threats and is the output of following the CTI lifecycle. It is the accumulation of all your and your team’s work and the ultimate value you bring to an organization. This is why it is so important to get it right.

Your intelligence consumer doesn’t care how you collect, process, or analyze information. They care about what insights you can deliver that will support them in deciding what action to take.

The action could be operational (e.g., performing threat hunts or building detections) or strategic (e.g., making security investments or resource allocation). It will depend on the intelligence consumer and their intelligence requirements.

CTI report writing is about delivering timely, actionable, and relevant information to someone who can do something with it. This could be a key event or trend that helps a key stakeholder decide a course of action, or an emerging threat that your organization must be made aware of so they can prepare accordingly.

To deliver this message, you need to structure your threat intelligence report so that it is easy to consume, includes key components your intelligence consumer will expect to see, and uses language that clearly answers three things:

1. What is a concern?
2. Why is it a concern?
3. How to deal with it?

If your intelligence consumer can clearly answer these three questions after reading your threat report, you’ve done your job.

In summary, good CTI report writing provides the following key benefits to a business:

So, CTI report writing is a crucial skill, but what makes a good CTI report, and what should you include in your report? Let’s explore the key elements of a CTI report.

---

Key Elements of a CTI Report

A good CTI report is analogous to an onion. There are layers that you wrap your threat report in, and gradually, it gets more detailed the deeper you go.  

You start with the structure (the outer layer) that organizes your writing into a digestible form for your reader. Then, key elements like headlines, leads, visuals, and calls to action are scattered throughout your CTI reporting, acting as guideposts to help your reader navigate it. Finally, you have the language used to communicate your findings – specific and tailored to your audience.

Structure

The most effective way to structure your CTI reports is by borrowing a technique from the journalist world, known as the inverted pyramid. This technique presents the most important information at the start of the article (or threat report, in our case), followed by additional details that gradually become more technical or less important overall.

In a CTI report, this usually takes the following form:

1. Headline
2. Executive summary
3. Key details or evidence
4. Supporting evidence
5. Technical details (e.g., malware analysis details)
6. Recommendations
7. Background information and appendices (e.g., IOCs, TTPs, detection rules).

The executive summary is the most important part of this structure. It needs to summarize your findings succinctly, explain how you came to your conclusions, and recommend what actions to take. Getting this part of your threat intelligence report right should be your priority. It will have the greatest impact on your reader; key stakeholders often won’t even read past these first few paragraphs.

Elements

Key elements are guideposts to help your reader navigate your threat intelligence report without having to read every word. The reader will expect to see them, so you had better include them.

These are the foundational elements that every CTI report must include. Depending on the type of intelligence you are writing about, there may be more key elements to include. For instance, a threat actor profile should include identifiers, motivations, capabilities, and TTPs.

Check out MITRE’s CTI Blueprints project for examples of different threat intelligence reports and what to include.

Language

The innermost layer of a CTI report is the language used to communicate your findings. This should be crafted to speak to your chosen audience. If you write for an executive, it could use high-level language that skips the technical details. On the other hand, it could be highly technical if you need to communicate a specific vulnerability to a member of the operations team.

Most intelligence reports are not just for one type of audience. They include details that an executive should know, as well as those that the security operations team can use. As such, it is common to start with an executive summary (geared toward executives) and gradually get more technical as the threat report gets into the weeds or you discuss the specific evidence that led to your conclusions.

Keep it simple and easily understandable, and only get technical when necessary. You want to ensure your CTI reporting speaks to the broadest audience possible.

Appendices are a good way to separate technical details that interrupt the flow and readability of your threat intelligence report. These can include all the IOCs, TTPs, or vulnerability details without bogging down the natural rhythm of your report writing, making your CTI report easier to read.

This excellent presentation by Selena Larson, a senior cyber threat analyst at Dragos, summarizes these three key components and why they are essential for writing clear and concise threat intelligence reports. She shares her experiences as a journalist and how they intertwine with CTI.

For a cyber threat intelligence report example, check out this article.

---

The CTI Report Writing Process

Although what makes a good CTI report is clear-cut, how you go about actually writing the threat report is down to you. Some analysts like to complete their assessment and have all the information upfront. Others want to create an outline before starting their assessment and fill it in as they go.

How you write your CTI reports is down to personal preference. I will share the CTI report writing process that has served me well over the years, enabling me to work more efficiently.

Research

Start by researching the topic, event, or outcome you are writing about in an intelligence assessment. Many analysts fail to gather background information or organize their evidence. Giving the reader context is key to good CTI report writing.

You may be an expert in your domain, but your intelligence consumer may not be. You must provide context that allows them to get up to speed on the threat landscape quickly.

Prepping the Page

Many writers find starting the most challenging part of the writing process. When faced with a blank page, knowing where to start or what to write can be daunting. This is where prepping the page comes in.

This simple writing technique will help you overcome writer’s block and get the ball rolling. You begin by outlining the main parts of your threat intelligence report, such as the headline, introduction, main points, and conclusion. Your big headings (H2s). From there, you write out the ideas you want to cover under these main components as H3s.   

Watch this video to learn more:

You want someone to be able to skim your H2s and H3s and get the main gist of the threat report. They should know where you’re going without having to read every word. Once you have an outline, you can start filling in the content.

Filling in the Content

To fill in the outline I created with content, I start by adding a few bullet points under each H3 that contain key ideas or evidence I want to discuss in each section. Next, I add a connecting sentence between the H2s so the threat report flows and the reader can seamlessly move between ideas.

This helps me organize the report’s general flow and reminds me of the key ideas or evidence to discuss in each section. After this skeleton is in place, you simply transform the bullet points into sentences. Easy.

I find it easiest to write the introduction, conclusion, and executive summary last. I prefer to address the bulk of the CTI report, including all the details, evidence, and ideas, before revisiting these three sections. Filling them in once your main content is done is very easy.

Adding Details, Visuals, and Citations

As you begin filling in the content of your threat intelligence report, you will come across points where you need to add more details, visuals, or citations. Don’t let this bog you down. Just note what you want to add and come back later to add it.

Effective CTI report writing is all about getting into a flow where you enter a state of transferring ideas, evidence, and knowledge to paper (or keyboard taps). The longer you can sustain this flow, the quicker and better your threat report will be. You can always add in the nitty-gritty details and pretty visuals later.

Review, Revise, and Publish

Once you have finished your first draft of the report, it’s time to review, revise, and publish. This is probably the most important step in the CTI report writing process, as you need to chisel your collection of evidence and judgments into a finely crafted finished product. The reader will scrutinize your CTI report for any mistakes, poor grammar, or key details you miss.

I strongly recommend using a grammar and punctuation checker like Grammarly when reviewing and revising your threat intelligence report. Tools like this will eliminate basic mistakes and force you to be more precise and more concise in your writing.

---

Best Practices for CTI Report Writing

Congrats, you know how to write a CTI report.

Mastering the creation of clear, engaging, and concise threat reports will take time and dedication. To help you get started, here are some best practices to focus on that will raise the level of your CTI report writing:

• Classifying the sensitivity of your report: Use an information classification framework like the Traffic Light Protocol (TLP) to ensure sensitive data is handled appropriately. This will help others share your threat report while remaining compliant with regulatory standards.
• Communicating the likelihood of your assessment: Make sure to include estimative language to add additional context, such as how certain you are that an event or outcome will happen based on the information available.
• Tailoring your report to the right audience: Ensure your threat report is fit for your target audience. The report’s length, language, and details should be tailored to deliver information to a specific intelligence consumer. Projects like MITRE’s CTI Blueprints can help you with this.
• Using well-known cyber security methodologies: Include relevant and well-known methodologies in your threat report where appropriate. This demonstrates that you collected and analyzed all available evidence appropriately. Popular ones include the Diamond Model, MITRE ATT&CK matrix, Cyber Kill Chain, and Analysis of Competing Hypotheses. Just don’t go overboard and include them all.
• Adding a course of action to your CTA: Don’t just report on a concern and why it’s a concern; also include a call to action that specifies how the intelligence consumer can address the problem. This could be IOCs or TTPs to hunt for or strategic security investments.
• Include detection opportunities: Adding IOCs and TTPs to your CTI report is excellent, but don’t just stop there. Add possible detection opportunities, pseudo logic that can be used to detect threats, or even complete detection rules like YARA and Sigma rules. These are incredibly valuable for security operations teams.

---

Conclusion

CTI report writing is an essential skill in your cyber security arsenal. It enables you to explain a threat, its concern, and how to defend against it, allowing your intelligence consumer to decide the appropriate course of action.

This guide has taught you the importance of CTI report writing, the key elements to include, and how to write a report. It also highlighted best practices for elevating your reports and making them stand out. Use this practical advice to start writing better CTI reports and bringing more value to your organization.

Just remember to tailor your threat intelligence reports to your target audience! For a cyber threat intelligence report example, check out this article.

Frequently Asked Questions