Cyber Security
Threat Intelligence
Understanding who attacks, how and why, and turning that into defences.
- 8 notes
- 65 minutes of reading
- What cyber threat intelligence is: strategic, operational, tactical and technicalAn introduction to cyber threat intelligence (CTI): how it differs from raw data, the four common levels of intelligence and who uses each one in an organisation. 7 min · Beginner
- The intelligence lifecycle: from requirements to feedbackThe six stages of the threat intelligence lifecycle, direction, collection, processing, analysis, dissemination and feedback, with practical examples and common pitfalls at each stage. 8 min · Intermediate
- IOCs versus TTPs and the Pyramid of PainThe difference between indicators of compromise (IOCs) and tactics, techniques and procedures (TTPs), and how the Pyramid of Pain helps you choose detections that hurt attackers most. 7 min · Intermediate
- MITRE ATT&CK: tactics, techniques and procedures for defendersHow the MITRE knowledge base of adversary tactics and techniques is structured, how to read a technique entry, and how defenders use it for detection, threat-informed planning and gap analysis. 9 min · Intermediate
- Analysis models: the Cyber Kill Chain and the Diamond ModelHow the Lockheed Martin Cyber Kill Chain and the Diamond Model of Intrusion Analysis help analysts structure attacks, plan defences and pivot between related evidence. 8 min · Intermediate
- Sharing threat intelligence: STIX, TAXII, ISACs and TLPHow organisations share threat intelligence safely: the STIX data format, the TAXII transport protocol, sector ISACs, the Traffic Light Protocol, and how to judge the quality of feeds. 8 min · Intermediate
- Threat intelligence platforms and practical use casesWhat a threat intelligence platform (TIP) does, how it connects to the SIEM, EDR and firewall, and the practical ways intelligence helps with alert triage, incident response, patching, fraud and brand protection. 9 min · Intermediate
- Malware analysis basics for defenders: static, dynamic and sandboxesAn introduction to malware analysis for SOC and threat intelligence work: the main types of malware, static and dynamic analysis, sandboxes, building a safe lab and turning findings into indicators and YARA rules. 9 min · Intermediate