Intelligence Domain

The Intelligence domain captures and structures the intelligence-gathering activities of an organization. It spans routine business reporting through to sophisticated competitive and geopolitical intelligence, enabling organizations to maintain an adaptive and informed operating model.

Schema: intelligence.schema.json
Specification: JSON Schema Draft-07

Overview

What is the Intelligence Domain?

The Intelligence domain captures structured approaches to gathering and analyzing internal and external intelligence, enabling evidence-based decision making. The domain covers:

• Business Reporting — Internal reporting and dashboarding
• Competitive Intelligence — Monitoring competitor activity
• Market Intelligence — External market trends and insights
• Regulatory Surveillance — Monitoring regulatory developments
• Security Intelligence — Physical and cybersecurity threats

This domain extends the Triodian Metamodel by providing frameworks for modeling intelligence sources, analysis processes, and application areas.

Purpose and Value

The Intelligence domain enables architects and planners to:

• Structure intelligence activities — Organize gathering and analysis
• Map sources — Catalog intelligence sources and reliability
• Support decisions — Enable evidence-based strategic planning
• Manage risks — Provide early warning for emerging risks
• Drive performance — Recalibrate KPIs based on real-world signals

For Data Engineers

The Intelligence domain maps to analytics and BI concepts:

• Intelligence Report → Report/dashboard entity
• Intelligence Source → Data source/connection
• Analysis → Analytics pipeline
• Intelligence Type → Report category/classification
• Application → Consumer/downstream system

Core Components

The Intelligence domain uses an intelligence cycle:

1. Planning: Define requirements and priorities
2. Collection: Gather from sources using methods
3. Analysis: Process and synthesize information
4. Dissemination: Distribute reports and briefings
5. Application: Support decisions and actions

Domain Attributes

Core Attributes

Attribute	Type	Description	Required
intelligenceID	String	Unique identifier	✓
title	String	Name of intelligence report/activity	✓
description	String	Description of intelligence content
purpose	String	Purpose of intelligence activity
owner	String	Responsible individual or team
orgUnitTitle	String	Organization unit accountable for or consuming the intelligence
orgUnitID	String	ID of the organization unit (see orgUnitTitle)
sources	Array[Object]	Intelligence sources used (see Intelligence Source)
intelligenceType	Enum	Type of intelligence (see below)	✓
frequency	Enum	Update frequency (shared frequency list, see below)
legalAndEthicalConsiderations	String	Legal/ethical restrictions
confidentialityLevel	Enum	Classification level
performanceIndicators	Array[String]	KPIs for usefulness
risks	Array[String]	Risks in collection or use
improvementOpportunities	Array[String]	Enhancement suggestions
strategicAlignment	String	Link to strategy
applications	Array[Object]	Application areas (see Intelligence Application)

Strategic Empathy Attributes

Attribute	Type	Description	Required
sentimentAnalysisCapability	Boolean	Ability to analyze stakeholder sentiment from sources such as social media and internal communications
stakeholderNetworkMapping	Boolean	Whether key internal and external stakeholders and their relationships are identified and mapped
culturalIntelligenceIntegration	Boolean	Ability to incorporate cultural nuances and contexts into intelligence analysis
unstructuredDataAnalysisForEmpathy	Boolean	Ability to extract emotional and unspoken insights from qualitative data

Enumeration Values

Intelligence Type (intelligenceType)

Value	Description	Example
businessReporting	Internal reporting and dashboards	Financial reports
competitiveIntelligence	Competitor monitoring	Competitor analysis
marketIntelligence	Market trends and insights	Market research
regulatorySurveillance	Regulatory monitoring	Compliance updates
securityIntelligence	Security threats	Cyber threat intel
insiderThreatMonitoring	Internal risk detection	Behavioral analytics
geopoliticalAnalysis	Political developments	Country risk
corporateEspionage	Competitor secrets	Trade secrets
agencyIntelligenceFeed	Government intelligence	Agency bulletins
socialMediaAndOsint	Open source intelligence	Social listening
darkWebMonitoring	Hidden internet sources	Threat monitoring

Frequency (frequency)

Value	Description
continuous	Continuous updates
realTime	Real-time updates
hourly	Hourly updates
daily	Daily updates
weekly	Weekly cycles
monthly	Monthly cycles
quarterly	Quarterly reports
semiAnnually	Twice-yearly reporting
annually	Annual reporting
eventDriven	Triggered by events
onDemand	Produced on request
adHoc	Irregular, as needed

Confidentiality Level (confidentialityLevel)

Value	Description
public	Freely available
internal	All employees
confidential	Select personnel
restricted	Certain executives
secret	High sensitivity
topSecret	Highest sensitivity

Source Type (sourceType)

Value	Description	Example
publicData	Freely available	News, filings
paidResearchServices	Purchased data	Bloomberg, Gartner
regulatoryFilings	Mandatory disclosures	SEC filings
informalNetworks	Industry contacts	Personal networks
thirdPartySubscription	Licensed datasets	Data vendors
darkWebSources	Hidden internet	Threat intelligence
socialMedia	Social media platforms	Social listening
governmentIntelligence	Agency sources	Government bulletins
corporateWhistleblowers	Insiders reporting concerns	Whistleblower hotline
surveillanceSystems	Monitoring systems	SIEM, DLP
internalMonitoring	The organization's own monitoring of its systems and staff	User behaviour analytics

Reliability Rating (reliabilityRating)

Value	Description
low	Seldom reliable
medium	Usually reliable
high	Consistently reliable
critical	Authoritative; relied on for critical decisions
unverified	Reliability not yet established
variable	Reliability varies between reports

Collection Method (collectionMethod)

Value	Description
manualResearch	Desk research by analysts
automatedScraping	Automated collection from websites and feeds
sensorBasedCollection	Collection from sensors and monitoring systems
thirdPartyAcquisition	Acquired from a third party
humanIntelligence	Gathered from people
signalsIntelligence	Gathered from communications and electronic signals
aiGeneratedSummarisation	Summarised by AI from collected material
manualInvestigation	Investigation of specific cases by staff

Application Area (applicationArea)

Value	Description
strategicDecisionMaking	Strategic planning and decisions
tacticalOperations	Day-to-day operational decisions, including security operations
mergersAndAcquisitions	M&A targeting and due diligence
newMarketEntry	Entering new markets
productDevelopment	Product planning and design
riskManagement	Identifying and managing risks
competitiveResponse	Responding to competitor moves
brandReputationManagement	Protecting brand and reputation
fraudPrevention	Detecting and preventing fraud

Intelligence Source and Application Elements

Intelligence Source (intelligenceSource)

Attribute	Type	Description	Required
sourceName	String	Name of source	✓
sourceType	Enum	Type of source (see above)	✓
reliabilityRating	Enum	Source reliability (see above)
collectionMethod	Enum	How intelligence is collected from the source (see above)
cost	String	Cost associated
complianceStatus	Enum	Compliance check outcome: compliant, partiallyCompliant, nonCompliant, underReview, exempt, notApplicable

Intelligence Application (intelligenceApplication)

Attribute	Type	Description	Required
applicationArea	Enum	Area where applied (see above)	✓
organisationalDecisionsInfluenced	String	Decisions informed
intelligenceConsumers	Array[String]	Roles using intelligence
measurableOutcomes	Array[String]	Outcomes from application

Domain Relationships

The Intelligence domain integrates with other metamodel domains:

Target Domain	Relationship Type	Description
Strategy	Input	Enables informed strategic planning
Market	Context	Provides competitive awareness
Risk Management	Warning	Early warning for risks
Performance	Calibration	Enables KPI recalibration
Technology	Enablement	Technology enables collection
Organization	Ownership	Org units manage intelligence
Policy	Compliance	Intelligence policies defined
Information	Source	Intelligence as information asset
Stakeholder	Analysis	Stakeholder intelligence
Customer	Insight	Customer intelligence

Examples

Example 1: Quarterly Competitor Analysis

{
  "intelligenceID": "ORGINT-001",
  "title": "Quarterly Competitor Market Share Report",
  "description": "Analysis of competitor market activities and positioning across key product segments",
  "purpose": "Guide marketing investments for Product Line A and inform competitive response strategies",
  "owner": "Head of Corporate Intelligence",
  "orgUnitTitle": "Corporate Strategy and Market Intelligence Division",
  "sources": [
    {
      "sourceName": "Industry Market Research Database",
      "sourceType": "paidResearchServices",
      "reliabilityRating": "high",
      "collectionMethod": "thirdPartyAcquisition",
      "cost": "$45,000/year",
      "complianceStatus": "compliant"
    },
    {
      "sourceName": "Public Financial Filings",
      "sourceType": "publicData",
      "reliabilityRating": "high",
      "collectionMethod": "manualResearch",
      "cost": "No cost",
      "complianceStatus": "compliant"
    },
    {
      "sourceName": "Trade Publication Monitoring",
      "sourceType": "thirdPartySubscription",
      "reliabilityRating": "medium",
      "collectionMethod": "automatedScraping",
      "cost": "$12,000/year",
      "complianceStatus": "compliant"
    }
  ],
  "intelligenceType": "competitiveIntelligence",
  "frequency": "quarterly",
  "legalAndEthicalConsiderations": "Follows GDPR and privacy regulations. Only public information sources monitored.",
  "confidentialityLevel": "confidential",
  "performanceIndicators": [
    "Faster response to competitor pricing changes",
    "Improved win rate in competitive deals",
    "Earlier detection of market entry threats"
  ],
  "risks": [
    "Incomplete data on private competitors",
    "Potential for analysis bias",
    "Information becoming outdated between cycles"
  ],
  "improvementOpportunities": [
    "Adopt automated social listening tools",
    "Integrate real-time pricing monitoring",
    "Expand coverage to emerging market competitors"
  ],
  "strategicAlignment": "Supports Market Expansion Goal 2025 and competitive positioning strategy",
  "applications": [
    {
      "applicationArea": "strategicDecisionMaking",
      "organisationalDecisionsInfluenced": "Product positioning, pricing strategy, market entry timing",
      "intelligenceConsumers": [
        "CEO",
        "Chief Strategy Officer",
        "VP Marketing",
        "Product Management"
      ],
      "measurableOutcomes": [
        "15% improvement in competitive win rate",
        "30% faster response to competitive threats"
      ]
    }
  ]
}

Example 2: Regulatory Change Monitoring

{
  "intelligenceID": "ORGINT-003",
  "title": "Monthly Regulatory Change Digest: Financial Services Sector",
  "description": "Structured summary of regulatory updates impacting financial service providers across Australia, UK, and EU",
  "purpose": "Ensure ongoing compliance and proactive adaptation to new regulatory requirements",
  "owner": "Regulatory Compliance Intelligence Lead",
  "orgUnitTitle": "Regulatory Affairs and Compliance Department",
  "sources": [
    {
      "sourceName": "Official Government Gazettes",
      "sourceType": "publicData",
      "reliabilityRating": "high",
      "collectionMethod": "manualResearch",
      "cost": "No cost",
      "complianceStatus": "compliant"
    },
    {
      "sourceName": "Thomson Reuters Regulatory Feed",
      "sourceType": "paidResearchServices",
      "reliabilityRating": "high",
      "collectionMethod": "thirdPartyAcquisition",
      "cost": "$12,000/year",
      "complianceStatus": "compliant"
    }
  ],
  "intelligenceType": "regulatorySurveillance",
  "frequency": "monthly",
  "confidentialityLevel": "internal",
  "performanceIndicators": [
    "Reduction in non-compliance incidents by 30% YoY",
    "Zero regulatory fines post-implementation"
  ],
  "strategicAlignment": "Supports Compliance Excellence Program",
  "applications": [
    {
      "applicationArea": "riskManagement",
      "organisationalDecisionsInfluenced": "Product compliance checks, internal policy updates",
      "intelligenceConsumers": [
        "Chief Risk Officer",
        "Head of Legal",
        "Compliance Managers"
      ],
      "measurableOutcomes": [
        "100% policy updates within 10 days of regulatory publication",
        "Reduction of manual compliance audits by 40%"
      ]
    }
  ]
}

Example 3: Insider Threat Monitoring

{
  "intelligenceID": "ORGINT-004",
  "title": "Insider Threat Behavioral Monitoring: Weekly Report",
  "description": "Early detection report on anomalous behavioral indicators within high-risk departments",
  "purpose": "Support protection of sensitive intellectual property and reduce internal fraud risks",
  "owner": "Chief Security Intelligence Analyst",
  "orgUnitTitle": "Enterprise Security Operations Centre (ESOC)",
  "sources": [
    {
      "sourceName": "Endpoint User Activity Monitoring System",
      "sourceType": "surveillanceSystems",
      "reliabilityRating": "high",
      "collectionMethod": "sensorBasedCollection",
      "cost": "$35,000/year licensing fee",
      "complianceStatus": "compliant"
    },
    {
      "sourceName": "Dark Web Monitoring Service",
      "sourceType": "darkWebSources",
      "reliabilityRating": "medium",
      "collectionMethod": "thirdPartyAcquisition",
      "cost": "$18,000/year",
      "complianceStatus": "compliant"
    }
  ],
  "intelligenceType": "insiderThreatMonitoring",
  "frequency": "weekly",
  "legalAndEthicalConsiderations": "Complies with employment law and privacy regulations. Employee notification provided.",
  "confidentialityLevel": "restricted",
  "performanceIndicators": [
    "Reduction in data exfiltration incidents by 70%",
    "Zero successful insider fraud cases"
  ],
  "strategicAlignment": "Supports Enterprise Risk Framework and data protection objectives",
  "applications": [
    {
      "applicationArea": "tacticalOperations",
      "organisationalDecisionsInfluenced": "Investigation prioritization, access control adjustments",
      "intelligenceConsumers": [
        "CISO",
        "HR Director",
        "Legal Counsel"
      ],
      "measurableOutcomes": [
        "Early detection of 95% of potential insider threats",
        "50% reduction in investigation time"
      ]
    }
  ]
}

Implementation Guidelines

Intelligence Program Best Practices

1. Define requirements — Align intelligence needs to business objectives
2. Validate sources — Assess reliability and compliance
3. Analyze systematically — Apply consistent analytical frameworks
4. Disseminate appropriately — Match classification to distribution
5. Measure value — Track intelligence impact on decisions

Intelligence Maturity Framework

The levels follow the shared maturity list in common.schema.json.

Level	Description	Characteristics
initial	Reactive intelligence	No formal process
repeatable	Basic capabilities	Some formal collection
defined	Structured program	Documented processes
managed	Measured program	KPIs and metrics
optimizing	Continuous improvement	Predictive capabilities

Source Reliability Assessment

OpenMetadata Integration

For Data Platform Teams

When integrating with OpenMetadata, map Intelligence entities as follows:

Triodian Element	OpenMetadata Entity	Notes
Intelligence Report	Dashboard	Intelligence dashboards
Intelligence Source	Database Service	Data source connections
Analysis	Pipeline	Analytics pipelines
Intelligence Type	Tag	Classification tags
Application Area	Glossary Term	Business context

# Example: Map Intelligence to OpenMetadata Dashboard
def create_intelligence_dashboard(intel):
    """
    Map Triodian Intelligence to OpenMetadata Dashboard
    """
    return {
        "name": intel["intelligenceID"].lower(),
        "displayName": intel["title"],
        "description": intel.get("description", ""),
        "dashboardType": "intelligence",
        "owner": {"name": intel.get("orgUnitTitle", ""), "type": "team"},
        "tags": [
            {"tagFQN": f"IntelligenceType.{intel['intelligenceType']}"},
            {"tagFQN": f"Confidentiality.{intel.get('confidentialityLevel', 'internal')}"},
            {"tagFQN": f"Frequency.{intel.get('frequency', 'adHoc')}"}
        ],
        "charts": [
            {
                "name": source["sourceName"].lower().replace(" ", "_"),
                "displayName": source["sourceName"],
                "chartType": "source"
            }
            for source in intel.get("sources", [])
        ]
    }

Schema Reference

• Repository: Triodian/Triodian_Metamodel
• Schema: intelligence.schema.json
• Specification: JSON Schema Draft-07
• License: Apache License 2.0

---

Previous: Social Change Domain | Next: Manufacturing Domain