CTI case studies
CTI · Put your knowledge to work in context.
The Certified Threat Intelligence Analyst (CTI) credential is designed for security professionals who want to demonstrate competence in producing and applying threat intelligence. It suits analysts, SOC staff, incident responders, and consultants moving from raw data to decision-ready intelligence. The CTI case studies are 5 cases and about 5,051 words.
1The Board Wants Dark Web Monitoring in 60 Days
You lead a four-person cyber threat intelligence (CTI) team at a regional bank with 14,000 employees and 9 billion in assets. After a peer bank suffered a data leak traced to a managed file-transfer vendor, your CISO forwards a board directive: 'stand up dark web monitoring within 60 days.' First-year budget is capped at 180,000.
1,044 words, about 5 min2The 3.8 Million Indicator Feed
Your managed security service provider (MSSP) runs a 55-analyst SOC for 1,200 clients. Seven commercial and open-source feeds deliver about 3.8 million indicators per day into a pipeline that enriches SIEM alerts by looking up source IPs and file hashes.
1,035 words, about 5 min3TLP:AMBER+STRICT and the ISAC Repost
You are the CTI lead at an electric utility that belongs to a regional ISAC. A peer utility shares a report marked TLP:AMBER+STRICT describing a phishing campaign against a shared turbine vendor.
1,032 words, about 5 min4Hunting LSASS Without the Telemetry
You are the threat hunting lead at a healthcare provider with 6,000 endpoints and 900 servers. EDR covers 82% of endpoints, Sysmon is deployed only on servers, PowerShell script block logging is off, and SIEM retention is 30 days.
955 words, about 5 min5The Analyst's Sock Puppet
You run a three-person CTI team at a manufacturing company. A new analyst is asked to monitor a Russian-language cybercrime forum and a Telegram channel where access brokers sell VPN credentials.
985 words, about 5 min