Advanced Cyber Threat Intelligence

Introduction

• Course introduction
• Introduction to the intelligence lifecycle

1. Collection

• Introduction to data collection
• Internal data acquisition
• External data sources
• Private data sources part 1
• Private data sources part 2
• Community data sources
• Public data sources part 1
• Public data sources part 2
• Leveraging OSINT part 1
• Leveraging OSINT part 2

2. Data Management and Processing

• Introduction to data processing
• Common CTI standards part 1
• Common CTI standards part 2
• Storage and integration
• Threat intelligence platforms

3. Analysis

• Introduction to analysis
• Analysis of competing hypothesis
• Cyber kill chain and diamond model
• Cyber kill chain and courses of action matrix

4. Campaign Analysis

• Introduction to campaigns
• Heatmap analysis
• Visual analysis
• MITRE ATT&CK and the MITRE threat groups track
• Threat intelligence naming conventions

5. Attribution

• Introduction to attribution
• Cognitive biases
• Logical fallacies
• How to manage biases
• Nation-state attribution part 1
• Nation-state attribution part 2

6. Dissemination and Sharing

• Introduction to dissemination
• Tactical intelligence
• Operational intelligence
• Strategic intelligence

7. Summary

• Summary