Tier-1 analysts never read your threat-intel enrichment panel - how do you fix the delivery?

## The failure is delivery, not intelligence A feed can be excellent and still change nothing, because the last hop - from the intel platform into the moment a human decides - is where most intelligence programmes fail. A tier-1 analyst working a queue has a fixed budget of seconds per alert. Anything that requires opening a second tool, remembering a portal password, or scrolling past the fold competes with that budget and loses. So the design question is never "is this intel good"; it is "where does the analyst's eye already go, and is the intel there". ## The three surfaces worth delivering into **1. The alert record itself.** The strongest placement is a field on the alert, populated at enrichment time, above the fold and adjacent to the artefact it describes. A field, not a panel: it renders in the queue view, it survives export into the case, and it is *searchable* - you can later ask how many alerts carried an intel match, which is the data you need for the measurement conversation. **2. The control the analyst already reaches for.** Pushing an indicator list into the endpoint or identity tooling means the match surfaces where the response actions are, in the same interface where the analyst can look at process ancestry or a session's history. It also means the match happens on artefacts the tool sees, not only on the fields your log pipeline happened to parse. **3. The case record.** Whatever the analyst writes up should inherit the intel automatically - source, artefact, reason - so the next person reading the case understands why the verdict went the way it did without repeating the lookup. What is *not* a delivery surface: a weekly PDF, a portal nobody has credentials for, a Slack channel that scrolls, or a wiki page. Those are reporting, and they reach a different audience for a different purpose. ## Content: what makes a hit move a verdict Placement gets it seen; content makes it useful. A number alone is inert - an analyst cannot reason about "risk 87". Four fields do almost all the work: - **Source**, because analysts learn quickly which of their sources deserve weight; - **First seen**, because a listing from two years ago against today's traffic is a different claim from one made this morning; - **Why it was listed**, in one clause - credential-harvesting page, command-and-control for a named tooling family, scanning infrastructure - because that is what connects to the behaviour in front of them; - **Validity window**, so an expired listing is visibly expired rather than silently authoritative. Add one more thing if you can: whether the artefact is *shared* infrastructure. A hit on an address a hundred of your hosts talk to daily should say so, because that single fact prevents most of the wasted escalations. ## Precision of the enrichment itself If every alert gets decorated, the decoration stops carrying information. Enrichment that fires on public resolver addresses, CDN edges and popular hosting ranges trains analysts to skip it, and once skipped it is skipped even when it matters. Treat the enrichment as having its own precision budget: suppress artefact classes that cannot support a verdict, and prefer marking fewer alerts with a stronger claim. This is a different question from whether an alerting rule pages too often - it is about whether *this decoration* is ever the thing that decides. ## Timing Delivery has a clock as well as a place. If the intel platform ingests nightly while alerts are worked in minutes, the enrichment arrives after the verdict was already written. Matching must happen at alert-creation time, and for the fast-moving artefact classes the feed must be consumed as a stream rather than a daily file. An enrichment that would have been decisive and arrived six hours late is indistinguishable from no enrichment at all. ## Proving it worked Adoption metrics - panel views, clicks - measure attention, not effect. The acceptance test is a sampled review of closed cases: pull a set of investigations that carried an intel match and ask whether the match is cited in the reasoning, and whether the verdict would plausibly have been different without it. What you are hunting for is the nameable case - the one where an analyst escalated in minutes because the landing domain in an ordinary-looking sign-in alert had been carried by one source before the first message was even delivered. One such case, written down with the timeline, is worth more in every subsequent conversation than a year of view counts. ## One caution Resist wiring intel matches straight into automatic severity escalation or automatic containment. The artefact list is curated outside your organisation; anything that mechanically converts a third party's listing into an action in your estate is a lever you do not fully own. Let intel raise a human's attention, and keep the decision to act on your side of the boundary.