Problem Solving
Intelligence Lifecycle
Planning, direction, collection, analysis, and dissemination.
Frameworks
Diamond Model, Kill Chain, and MITRE ATT&CK.
Intelligence Requirements
Defining PIRs and setting the direction for collection.
Requests for Information
Generating and answering intelligence requirements.
Basic Malware Analysis
Static vs Dynamic analysis for CTI practitioners.
Indicators of Compromise
Types of indicators: Atomic, Computed, and Behavioral.
Professional Effectiveness
Intelligence Fundamentals
Core concepts, definitions, and the importance of CTI.
Effective Communication
Communicating findings to stakeholders effectively.
Course of Action Development
Predicting adversary behavior and recommending responses.
Data Marking
TLP, PAP, and ensuring information security.
Data Management
Managing platforms, sources, and collection frameworks.
Technical Literacy
Intelligence in Cyberspace
Understanding the digital battlefield and its unique properties.
Operating Systems
Foundational principles of Windows, Linux, and macOS for CTI.
Networking Fundamentals
The OSI model, TCP/IP, common ports, and DNS in intelligence.
CIA Triad
Core security concepts and their application in threat assessment.
Cloud Computing
Service models, deployment models, and shared responsibility.
Cryptography
Encryption, hashing, and their use by both defenders and actors.
Policy
Understanding IRP, BCP, and DRP from an analyst's perspective.
Security Technologies
Network boundaries, endpoint security, and log management.
Cybersecurity Roles
Operations, specialist roles, and the CTI analyst's place.
Cyber Threat Proficiency
Threat Actors & Profiling
Identifying motivations, capabilities, and intent.
Attack Surface
Mapping external visibility and vulnerabilities.
Threat Landscape
Current trends, emerging threats, and geopolitical factors.
Tracking & Attribution
Clustering activity and identifying threat actors.
Adversary Emulation
Testing defenses by mimicking real-world threat behaviors.
CVEs
CVE process, CVSS, and Exploit Prediction (EPSS).
Bug Bounty Programs
Responsible disclosure and bug bounty platforms.
Adversary Frameworks
Post-exploitation and exploit frameworks like Cobalt Strike.
Criminal Marketplaces
Dark web, infostealer logs, and initial access brokers.
Challenges
SSL/TLS Infrastructure
Identify infrastructure using certificate pivot points.
Strings Analysis
Extract unique artifacts from binary content.
TLP Classification
Apply Traffic Light Protocol (TLP 2.0) to sharing scenarios.
MITRE ATT&CK Mapping
Identify tactics and techniques from threat reports.
Diamond Model Reconstruction
Reconstruct an event using the Diamond Model vertices.
PIR Development
Write an effective PIR for a healthcare organization.