Eight chapters on the full CTI lifecycle: IOC types and confidence scoring, threat actor profiling using the Diamond Model, STIX/TAXII sharing infrastructure, intel-driven hunt methodology, campaign intelligence, and converting finished intelligence into detection rules. Built for SOC analysts, threat hunters, and detection engineers who need to move beyond raw IOC feeds.
What threat intelligence is, what it is not, and why the distinction matters. The intelligence cycle, types of intelligence, and who consumes each type.
IP addresses, domains, hashes, URLs, and behavioral indicators. The Pyramid of Pain, IOC lifecycle, confidence scoring, and managing indicator quality over quantity.
Actor naming conventions across vendors, motivation and intent taxonomies, the Diamond Model, and using TTPs as actor fingerprints that survive infrastructure changes.
STIX 2.1 object types and relationships, TAXII protocol mechanics, MISP and OpenCTI, ISAC membership, and sharing etiquette in trust communities.
Reading CTI reports for huntable content, building pivot chains from IOCs to actor infrastructure, enrichment workflows, and converting TTP descriptions to search queries.
Malware family classification, sandbox report interpretation, campaign clustering, code overlap attribution, YARA rule basics, and consuming malware intelligence feeds.
Tactical bulletins vs strategic assessments, PIRs and RFIs, BLUF structured writing, executive vs technical reports, dissemination, and measuring report quality.
The TI-to-detection pipeline, ATT&CK Navigator coverage mapping, Sigma rule writing from actor TTPs, KQL from IOC reports, detection tuning with intel context, and closing the feedback loop.
WHAT YOU SHOULD KNOW
WHAT YOU WILL KNOW AFTER
H3AD-SEC tools that pair directly with this module's content.
Multi-source IOC analysis across VirusTotal, Shodan, OTX, and AbuseIPDB. Applies confidence weighting per source to score indicators in real time.
Visual pivot graph for threat investigations. Map IOC relationships, actor infrastructure, and campaign connections during active intelligence analysis.
ATT&CK-driven hypothesis platform. Convert threat actor TTP profiles from CTI reports into structured hunt hypotheses using the ABLE framework.
Deep DNS intelligence: passive DNS history, subdomain enumeration, WHOIS, and registrar risk scoring. Essential for pivoting across actor infrastructure.