F2T2EA: Find, Fix, Track, Target, Engage, Assess

The US joint targeting cycle (JP 3-60) that F3EAD descends from. F2T2EA is the ops-pure original: Find → Fix → Track → Target → Engage → Assess. Adapted to Cyber Threat Intelligence it is the discipline of locating an adversary, pinning it down, watching it, deciding what to do, doing it, and measuring the result. The key insight: Assess feeds the Find of the next cycle -- the loop is what makes targeting repeatable.

The F2T2EA loop

locate → act → feedback to locate

loops back to Find

1. Find — Locate the target

The collection half of the cycle: identify targets of interest from PIRs, partner tipping, anomaly reports, and the Assess outputs of prior cycles. In F2T2EA, Find is deliberately broad -- you locate before you decide anything about the target.

Who: Intel + SOC (tipping, intel reqs, PIRs, OSINT, dark-web)
Defender goal: Discover the adversary, campaign, or asset that warrants action.
Primary deliverables: Named target (host, account, domain, or infrastructure set)
Priority Intelligence Requirements (PIRs)
Initial collection plan
Common pitfalls: Skipping PIRs -- results in undirected collection and noisy leads.
Confusing Find with Fix. Locating is not the same as pinning the target down.
Framework mapping: Maps loosely to ATT&CK Reconnaissance + Resource Development.

Use platform tool: ACH (analyze competing hypotheses)

Walk an incident through F2T2EA

A 6-step click-through using the Lazarus / Copperhedge sample already in the platform'sAI Report showcaseas the running example. Click a step to jump to that phase.

Step 1 of 6 · Find

Tip: Lazarus exploiting CVE-2025-55182

A partner feed + a CTF IoC report named Lazarus exploiting CVE-2025-55182 against financial / blockchain infra. The platform pulls the sample into the AI Report showcase.

Artifacts produced at this step

PIR: "Is Lazarus using CVE-2025-55182 against our React/Next.js surface?"
Initial collection plan: greynoise + ctfiot + our perimeter logs

next: Fix

F2T2EA vs. the other frameworks on the platform

F2T2EA is a process framework from joint targeting doctrine. It does not replace ATT&CK, the Kill Chain, or Diamond; it sits beside them as the loop that turns their outputs into a decision to act.

					Note
F2T2EA	process	How do we locate, track, and act on a target?	Ops + IR (targeting)	/ti/f2t2ea	The joint targeting cycle. Ops-pure -- the Assess phase carries the learning.
F3EAD	process	How does the team operate end-to-end on a target?	CTI + SOC + IR	/ti/f3ead	F2T2EA plus an explicit intelligence cycle (Exploit/Analyze/Disseminate).
Lockheed Kill Chain	content	What phases did the intrusion pass through?	DFIR + SOC	/d/kill-chain	Linear, 7 phases. Describes the intrusion, not the targeting decision.
MITRE ATT&CK	content	Which specific techniques did the adversary use?	Detection eng + CTI	/ti/mitre	The shared vocabulary. F2T2EA maps its phases onto ATT&CK tactics.
Diamond Model	content	Who did what to whom, and how?	CTI + IR	/d/diamond	Per-event reconstruction. Helps Fix and Assess.
ACH	process	Which hypothesis best explains the evidence?	CTI analysts	/ti/ach	Structured analytic technique used inside Fix and Assess.

References

JP 3-60 (Joint Targeting) — the joint doctrine that codifies the Find–Fix–Track–Target–Engage–Assess cycle.
FM 3-05.40 (Army Special Operations Forces) — the doctrinal source the F2T2EA / F3EAD targeting cycle descends from.
JP 3-05.1 (Joint Special Operations) — joint special-operations doctrine that adapts F2T2EA into the F3EAD process. See the full F3EAD reference page.
SANS FOR578 — Cyber Threat Intelligence — teaches F3EAD (the F2T2EA descendant) as the canonical CTI workflow.
MITRE ATT&CK Blog: "F3EAD: Operationalizing Cyber Threat Intelligence" (2018) — traces the lineage from joint targeting (F2T2EA) to the CTI mainstream.
NIST SP 800-61 rev 2 — Computer Security Incident Handling Guide — the IR phases (Preparation, Detection & Analysis, Containment, Eradication, Recovery, Post-Incident Activity) that Target and Engage align to.