Threat Intelligence Fundamentals

About this course

Learn how threat intelligence teams turn raw data into decisions. The course covers intelligence requirements, collection, indicators and their limits, frameworks for describing adversary behaviour, analytic rigour and writing intelligence products for different audiences.

What you will learn

• Define intelligence requirements with stakeholders
• Collect and enrich indicators of compromise
• Describe adversary behaviour using established frameworks
• Apply structured analytic techniques and confidence levels
• Write intelligence products for technical and executive audiences

Curriculum

Lesson content is being written and reviewed. Lessons unlock as they are published.

1. Module 1 · 50 min

   Intelligence foundations

   What threat intelligence is and how it is used.

   1. Strategic, operational and tactical intelligenceComing soon
   2. Intelligence requirementsComing soon
   3. Module 1 knowledge checkComing soon

2. Module 2 · 1 h 15 min

   Collection and indicators

   Sources, indicators and their limitations.

   1. Collection sourcesComing soon
   2. Indicators and the pyramid of painComing soon
   3. Enrichment and pivotingComing soon
   4. Module 2 knowledge checkComing soon

3. Module 3 · 1 h

   Adversary behaviour

   Describing what attackers do and why.

   1. Behaviour frameworksComing soon
   2. Tracking campaigns and clustersComing soon
   3. Module 3 knowledge checkComing soon

4. Module 4 · 55 min

   Analysis

   Reasoning carefully under uncertainty.

   1. Cognitive bias in analysisComing soon
   2. Structured analytic techniquesComing soon
   3. Module 4 knowledge checkComing soon

5. Module 5 · 1 h

   Communicating intelligence

   Products that people actually use.

   1. Writing for your audienceComing soon
   2. Sharing intelligence safelyComing soon
   3. Final assessmentComing soon