How to operationalize threat intelligence: the intake-to-evidence workflow