[Purpose/significance] To effectively respond to diversified, concealed, high-intensity, large-scale, and persistent cyberspace security threats, it is imperative to construct an integrated, comprehensive, and intelligent cyber⁃space security intelligence service architecture. [Method/process] Using the enhanced Hall model as the analytical framework and adhering to the principles of centering on cyberspace security and security intelligence as a service, this study constructs a cyberspace security intelligence service architecture and deeply analyzes its operating mechanism.[Result/conclusion] The cyberspace security intelligence service architecture consists of three components: process submodule, logic submodule, and cognition submodule. The service processes cater to three types of demands: cyber⁃space security perception, cyberspace security judgment, and cyberspace security execution. The service work reflects the operating logic of " attack scenario traceability-event correlation identification-crisis response escalation". The
cognition of cyberspace security intelligence services is mainly embodied in three aspects: value consensus, technical support, and capability guarantee. The construction of the cyberspace security intelligence service architecture can pro⁃ vide a reference for intelligence service work in China's cyberspace security guarantee system.