In the Threat Intelligence Lifecycle, which stage involves collecting all needed data for the end goal?

• A. Analysis
• B. Dissemination
• C. Feedback
• D. Collection

Answer: (D)

The essential idea here is gathering all the data needed to answer the intelligence questions and achieve the end goal. During collection, you define what information is required (types, sources, time window) and actively obtain it from relevant channels—internal logs, external feeds, OSINT, partner intel, etc. The aim is to assemble a complete, high-quality dataset that will feed into processing and analysis. Without thorough collection, later stages won’t have enough or the right inputs, leading to gaps in the final intelligence.

Analysis uses the gathered data to derive insights and conclusions, dissemination shares those findings with stakeholders, and feedback helps refine future collection and analysis. But the step focused on "collecting all needed data for the end goal" is the collection stage.