Volver a las rutas de aprendizajeCyber Threat Intelligence
Ask better intelligence questions and connect what you learn to a defensive decision.
Move beyond static IOC feeds to operational cyber threat intelligence that informs detection engineering, threat hunting hypotheses, and security architecture.
Objetivo
Learn how to extract adversary TTPs, map campaigns to MITRE ATT&CK, and translate intelligence reports into concrete detection priorities.
Habilidades base sugeridas
General familiarity with the Cyber Kill Chain and MITRE ATT&CK enterprise matrix- Basic understanding of malware delivery mechanisms and command-and-control channels
Progresión del aprendizaje
Define Operational Intelligence Requirements
Frame intelligence questions based on your organization’s crown jewels, tech stack, and realistic adversary threat profile.
Climb the Pyramid of Pain
Prioritize adversary behaviors, tools, and TTPs over volatile hashes and IP addresses that adversaries change trivially.
Extract, Correlate, and Enrich IOCs
Use Jupyter notebooks and MSTICpy to pivot across synthetic and real telemetry, extracting indicators with contextual metadata.
Feed Intelligence to Detection Engineering
Close the loop by converting finished intelligence assessments into deployable hunting queries and detection rules.
Tu primer recurso
Comienza con esta sesión gratuita y práctica antes de avanzar en la secuencia.
CTI 101: Intelligence into Action
35 min
Blue vs. Red with AI
From Attacker Playbooks to Defender Detections: el plan de estudios insignia que profundiza en esta área.
