OODA Loop: Observe, Orient, Decide, Act

John Boyd's decision cycle from fighter combat, adapted to cyber defense. The OODA loop is how a teamout-tempos an adversary: Observe the environment, Orient it with context and prior knowledge, Decide a response, and Act -- then loop. The key insight: the loop is continuous, and speed comes from compressing it. OODA is the tempo-setting cycle underneath targeting frameworks like F2T2EA and F3EAD.

The OODA loop

observe → orient → decide → act → repeat

loops back to Observe

1. Observe — Collect what is happening

The raw intake of the loop: telemetry, logs, intel feeds, partner tipping, and the results of your own prior Actions. Observation is worthless without the Orient step -- the same data means different things to different analysts.

Who: SOC + Intel (telemetry, feeds, tipping)
Defender goal: See the environment as it actually is -- not as you assume it is.
Primary deliverables: Raw alerts, logs, and feed hits
Collection gaps noted (what we cannot see)
Updated situational picture
Common pitfalls: Falling into an alert-driven loop -- reacting to every ping without orienting first.
Assuming your sensors see everything. Gaps in coverage are data too.
Framework mapping: Maps loosely to ATT&CK Reconnaissance + telemetry sources (TA0007-ish).

Use platform tool: IOC check (multi-engine)

Walk an incident through OODA

A 4-step click-through using the Lazarus / Copperhedge sample already in the platform'sAI Report showcaseas the running example. Click a step to jump to that phase.

Step 1 of 4 · Observe

Telemetry: RSC deserialization probes

A partner feed + a CTF IoC report named Lazarus exploiting CVE-2025-55182. Simultaneously the WAF + load balancer logs show the list.txt scanning pattern hitting our Next.js 15.x prod apps.

Artifacts produced at this step

Raw hits: greynoise + ctfiot + perimeter logs
Noted gap: no visibility into staging app telemetry

next: Orient

OODA vs. the other frameworks on the platform

OODA is a process framework about decision tempo. It does not replace ATT&CK, the Kill Chain, or Diamond; it sits underneath them as the cycle that turns their outputs into faster decisions.

					Note
OODA Loop	process	How fast can we decide and act?	IR + SOC (tempo)	/ti/ooda	Boyd's decision cycle. The inner loop that sets the tempo underneath F2T2EA / F3EAD.
F2T2EA	process	How do we locate, track, and act on a target?	Ops + IR (targeting)	/ti/f2t2ea	The joint targeting cycle. OODA runs inside its Find-Target-Engage phases.
F3EAD	process	How does the team operate end-to-end on a target?	CTI + SOC + IR	/ti/f3ead	F2T2EA plus an explicit intelligence cycle (Exploit/Analyze/Disseminate).
Lockheed Kill Chain	content	What phases did the intrusion pass through?	DFIR + SOC	/d/kill-chain	Linear, 7 phases. Describes the intrusion, not the decision cycle.
Unified Kill Chain	content	How does the full campaign unfold across In / Through / Out?	CTI + DFIR + SOC	/ti/unified-kill-chain	The 18-phase meta-framework (Pols 2017) synthesizing the kill chain + ATT&CK.
MITRE ATT&CK	content	Which specific techniques did the adversary use?	Detection eng + CTI	/ti/mitre	The shared vocabulary. ATT&CK mapping happens inside Orient.
Diamond Model	content	Who did what to whom, and how?	CTI + IR	/d/diamond	Per-event reconstruction. Feeds Orient and Assess.
ACH	process	Which hypothesis best explains the evidence?	CTI analysts	/ti/ach	Structured analytic technique used inside Orient and Decide.

References

John Boyd, "A Discourse on Winning and Losing" — the 1987 briefing that formalized the OODA loop.
Robert Coram, "Boyd: The Fighter Pilot Who Changed the Art of War" (2002) — the biography that carried OODA from military circles into business and cyber.
"Getting Inside the Enemy's OODA Loop" (Boyd, 1987) — the tempo argument: act faster than the adversary can react.
MITRE ATT&CK Blog: "F3EAD: Operationalizing Cyber Threat Intelligence" (2018) — positions the F2T2EA / F3EAD targeting cycle that OODA tempo drives.
SANS FOR578 — Cyber Threat Intelligence — treats decision cycles (OODA) as the tempo layer under the CTI workflow.
NIST SP 800-61 rev 2 — Computer Security Incident Handling Guide — the IR phases that the Decide and Act steps align to.