SER-006 — Operational Intelligence
**Operational intelligence as decision support**—how organizations use **internal** operational knowledge to prioritize attention, investigations, and risk actions. **Not** SOC runbooks, SIEM query guides, or tool configuration.
SER-006 — Operational Intelligence
Series: SER-006
Volume: VOL-002 Intelligence
Version: 1.0
Fundamental question: How should organizations transform operational knowledge into better security decisions?
Pillar: PIL-OP-INTEL
Season: SEA-004
Status: ✅ Complete — FROZEN (D1 drafts)
Review: Every 6 months (next: 2027-01-03)
Expansion: SER-006 v2.0 only
Learning path: LP-006
Prerequisite: SER-005 + Volume 1 (minimum: KID-CON-0030)
Purpose
Operational intelligence as decision support—how organizations use internal operational knowledge to prioritize attention, investigations, and risk actions. Not SOC runbooks, SIEM query guides, or tool configuration.
Educational flow: External TI (SER-005) → Internal OI → decisions
Authority anchors: KID-GLS-0006, KID-OIN-0001
Foundation for: SER-007 Security Intelligence
TI vs OI boundary
| Threat Intelligence | Operational Intelligence |
|---|---|
| External environment | Internal environment |
| Threat actors | Organization state |
| Campaigns | Assets, identities, telemetry, controls |
| Global context | Local context |
Reading order
| Order | KID | Article | Time |
|---|---|---|---|
| 1 | KID-GLS-0006 | Operational Intelligence | 3 min |
| 2 | KID-CON-0060 | Understanding Operational Intelligence | 9 min |
| 3 | KID-CON-0061 | Operational Intelligence vs Operational Data | 8 min |
| 4 | KID-CON-0062 | Common Misconceptions About Operational Intelligence | 10 min |
| 5 | KID-CON-0063 | Why Context Changes Operational Decisions | 8 min |
| 6 | KID-CON-0064 | Operational Intelligence in Daily Security Operations | 9 min |
| 7 | KID-CON-0065 | Operational Intelligence and Investigations | 9 min |
| 8 | KID-CON-0066 | Operational Intelligence and Risk Decisions | 8 min |
| 9 | KID-GLS-0026 | Operational Signal | 3 min |
| 10 | KID-GLS-0027 | Operational Context | 3 min |
| 11 | KID-CON-0067 | When Operational Intelligence Is Not Enough | 8 min |
| 12 | KID-CON-0068 | Operational Intelligence as Decision Support | 10 min |
FAQs
| KID | Question | Parent |
|---|---|---|
| KID-FAQ-0003 | What is operational intelligence? | KID-CON-0060 |
| KID-FAQ-0031 | TI vs OI difference? | KID-CON-0060 |
| KID-FAQ-0032 | OI same as SIEM data? | KID-CON-0061 |
| KID-FAQ-0033 | OI in daily ops? | KID-CON-0064 |
| KID-FAQ-0034 | OI replace risk analysis? | KID-CON-0066 |
| KID-FAQ-0035 | When ignore OI rank? | KID-CON-0067 |
Collection statistics
| Asset type | Count |
|---|---|
| Educational articles | 9 |
| Glossary (series) | 3 |
| FAQ attachments | 6 |
| New KIDs | 14 |
| Cumulative KIDs | 134 |