Back to learning pathsCyber Threat Intelligence
Ask better intelligence questions and connect what you learn to a defensive decision.
Move beyond static IOC feeds to operational cyber threat intelligence that informs detection engineering, threat hunting hypotheses, and security architecture.
Intended goal
Learn how to extract adversary TTPs, map campaigns to MITRE ATT&CK, and translate intelligence reports into concrete detection priorities.
Suggested baseline skills
General familiarity with the Cyber Kill Chain and MITRE ATT&CK enterprise matrix- Basic understanding of malware delivery mechanisms and command-and-control channels
Learning progression
Define Operational Intelligence Requirements
Frame intelligence questions based on your organization’s crown jewels, tech stack, and realistic adversary threat profile.
Climb the Pyramid of Pain
Prioritize adversary behaviors, tools, and TTPs over volatile hashes and IP addresses that adversaries change trivially.
Extract, Correlate, and Enrich IOCs
Use Jupyter notebooks and MSTICpy to pivot across synthetic and real telemetry, extracting indicators with contextual metadata.
Feed Intelligence to Detection Engineering
Close the loop by converting finished intelligence assessments into deployable hunting queries and detection rules.
Your first resource
Begin with this free, practical session before advancing through the sequence.
CTI 101: Intelligence into Action
35 min
Blue vs. Red with AI
From Attacker Playbooks to Defender Detections: the flagship curriculum that goes deep in this area.
