SER-007 — Security Intelligence
**Security intelligence as decision support**—how organizations **integrate** external threat knowledge and internal operational knowledge into a **unified security decision process**. **Not** a third feed catalog, unified vendor platform tour, or autonomous SOC narrative.
SER-007 — Security Intelligence
Series: SER-007
Volume: VOL-002 Intelligence (capstone)
Version: 1.0
Fundamental question: How should organizations integrate external and internal intelligence into a unified security decision process?
Pillar: PIL-SECURITY-INTEL
Season: SEA-005
Status: ✅ Complete — FROZEN (D1 drafts)
Review: Every 6 months (next: 2027-01-03)
Expansion: SER-007 v2.0 only
Learning path: LP-007
Prerequisite: SER-005 (KID-CON-0058) + SER-006 (KID-CON-0068) + Volume 1
Purpose
Security intelligence as decision support—how organizations integrate external threat knowledge and internal operational knowledge into a unified security decision process. Not a third feed catalog, unified vendor platform tour, or autonomous SOC narrative.
Educational flow: SER-005 (external) + SER-006 (internal) → Integrated intelligence → decisions
Authority anchors: KID-GLS-0028, KID-TIN-0001, KID-OIN-0001
Closes: Volume 2 — Intelligence
Volume 2 synthesis
SER-005 Threat Intelligence → external → decisions
SER-006 Operational Intelligence → internal → decisions
SER-007 Security Intelligence → integrated → decisions
↓
Volume 1: Evidence · Investigation · Risk · Attack Paths
Reading order
| Order | KID | Article | Time |
|---|---|---|---|
| — | — | Prerequisite: SER-005, SER-006, Volume 1 | — |
| 1 | KID-GLS-0028 | Security Intelligence | 3 min |
| 2 | KID-CON-0070 | Understanding Security Intelligence | 9 min |
| 3 | KID-CON-0071 | Integrating Threat and Operational Intelligence | 9 min |
| 4 | KID-CON-0072 | Common Misconceptions About Security Intelligence | 10 min |
| 5 | KID-CON-0073 | Security Intelligence in Prioritization | 9 min |
| 6 | KID-CON-0074 | Security Intelligence in Investigation | 9 min |
| 7 | KID-CON-0075 | Communicating Intelligence to Stakeholders | 9 min |
| 8 | KID-CON-0076 | When Intelligence Conflicts With Evidence | 9 min |
| 9 | KID-CON-0077 | Security Intelligence as Decision Support | 10 min |
Practitioner questions answered
| Question | Primary KID |
|---|---|
| What is security intelligence? | KID-CON-0070, KID-GLS-0028 |
| How integrate TI and OI? | KID-CON-0071 |
| What mistakes do teams make? | KID-CON-0072 |
| How use SI in prioritization? | KID-CON-0073 |
| How use SI in investigation? | KID-CON-0074 |
| How communicate to stakeholders? | KID-CON-0075 |
| What when intel conflicts with evidence? | KID-CON-0076 |
| What is the Volume 2 thesis? | KID-CON-0077 |
Glossary (series terms)
| KID | Term | Status |
|---|---|---|
| KID-GLS-0028 | Security Intelligence | ✅ new authority |
| KID-GLS-0005 | Threat Intelligence | ✅ shared (SER-005) |
| KID-GLS-0006 | Operational Intelligence | ✅ shared (SER-006) |
| KID-GLS-0023 | Decision Support | ✅ shared (VOL-001) |
| KID-GLS-0024 | Intelligence Confidence | ✅ shared (SER-005) |
FAQs (attached)
| KID | Question | Primary parent |
|---|---|---|
| KID-FAQ-0036 | What is security intelligence? | KID-CON-0070 |
| KID-FAQ-0037 | How do TI and OI work together? | KID-CON-0071 |
| KID-FAQ-0038 | Can intelligence override evidence? | KID-CON-0076 |
| KID-FAQ-0039 | How communicate intelligence to executives? | KID-CON-0075 |
| KID-FAQ-0040 | What is SI as decision support? | KID-CON-0077 |
Not in scope (v1.0)
- Unified intelligence platform product tours
- Autonomous SOC or "AI brain" narratives
- Generic decision theory or enterprise GRC
- STIX/TAXII or feed ingestion mechanics
Collection statistics
| Asset type | Count |
|---|---|
| Educational articles | 8 |
| Glossary (series) | 1 new (+ shared) |
| FAQ attachments | 5 |
| New KIDs | 14 |
| Cumulative KIDs | 150 |