A structured methodology for the direction and planningphase of the cyber threat intelligence cycle : reducinginformational noise and aligning with the regulatoryframework of the brazilian national financial system

Abstract

The exponential growth of cyber threats targeting Critical Infrastructures has intensified the problem ofinformation overload within Cyber Threat Intelligence (CTI) operations. Although CTI is widely adoptedas a proactive cybersecurity capability, its effectiveness is frequently constrained by indiscriminate datacollection practices that overwhelm analysts and weaken strategic relevance. This challenge is particularlycritical in the Brazilian National Financial System (SFN), where recent prescriptive regulatory updateshave transitioned CTI from a recommended capability to a mandatory technical control, requiring institu tions to monitor the surface, deep, and dark web with absolute traceability. This dissertation proposes astructured methodology for the Direction and Planning phase of the intelligence cycle, aimed at reducinginformational noise and aligning intelligence production with regulatory and operational requirements.The methodology is grounded in classical intelligence doctrine and organized into five stages: StrategicAlignment of critical assets, Threat Mapping, definition of Priority Intelligence Requirements (PIRs), for mulation of Requests for Information (RFIs), and development of an audit-oriented Collection Plan basedon the 5W3H framework. The proposed approach was implemented through an automation layer integra ted into the OpenCTI platform, translating governance-level intelligence requirements into deterministicfiltering rules. A conceptual case study using real open-source threat intelligence feeds demonstrated anoise reduction of 99.58%, reducing an initial dataset of 216,208 STIX Domain Objects to 903 SFN high fidelity intelligence artifacts. The results confirm that the strategic alignment of intelligence requirementswith institutional needs and the prescriptive regulatory landscape significantly enhances relevance, ensu ring auditable compliance and shifting CTI operations from the exhaustive triage of ephemeral Indicatorstoward behavior-focused, decision-oriented intelligence.