CTI study plan
CTI · Give each week a clear focus.
8 weeks · About 7 hours per week
Introduction to Threat Intelligence & Threat Intelligence Lifecycle and Planning
Define threat intelligence and distinguish it from raw data, information, and finished intelligence, writing your own one-sentence definition of each.
Map the intelligence lifecycle (direction, collection, processing, analysis, dissemination, feedback) onto a real incident you can recall, labeling where each stage occurred.
Draft a one-page intelligence requirements document for a fictional organization, including three priority intelligence requirements (PIRs) and two specific intelligence requirements (SIRs) beneath each.
Identify the stakeholders who consume threat intelligence in a typical enterprise and note the decision each one makes with it.
Your checkpoint
A one-page requirements plan containing a data-to-intelligence definitions table and a PIR/SIR hierarchy with at least three PIRs and six SIRs.
Threat Intelligence Lifecycle and Planning & Threat Data Collection and Processing
Build a collection plan that maps each SIR from week 1 to at least one source type (OSINT, commercial feed, ISAC, internal telemetry) and a collection cadence.
Compare at least five source categories on cost, latency, reliability, and legal constraints, and record the comparison in a table.
Describe the processing steps that turn raw indicators into normalized, deduplicated, and enriched records, including at least three concrete normalization decisions (for example timestamp format, indicator defanging, and confidence scoring).
Evaluate two realistic collection risks (source poisoning, over-collection, licensing limits) and state a mitigation for each.
Your checkpoint
A collection plan spreadsheet or table with one row per SIR, columns for source, cadence, cost, confidence, and legal constraint, plus a written processing-stage description of at least 250 words.
Threat Intelligence Frameworks and Standards & Threat Intelligence Types and Sources
Explain how the intelligence levels (strategic, operational, tactical) differ in audience, time horizon, and content, and give one concrete product example for each.
Walk through the main phases of the MITRE ATT&CK framework and map five adversary techniques to the tactic they belong to, without looking at the answer key first.
Compare the Traffic Light Protocol (TLP) 2.0 designations and state who may share what under each.
Summarize how STIX and TAXII relate to one another and what problem each solves in indicator exchange.
Classify five sample intelligence products by level and by source type (OSINT, HUMINT, SIGINT-derived, internal telemetry).
Your checkpoint
A framework reference sheet that maps five techniques to tactics, lists all TLP 2.0 designations with sharing rules, and explains STIX versus TAXII in under 150 words each.
Threat Analysis and Production & Threat Data Collection and Processing
Apply a structured analytic technique such as analysis of competing hypotheses (ACH) to a simple scenario and document the hypotheses, evidence, and conclusion.
Assess the quality of a set of indicators using a confidence and severity rubric you define yourself, and justify each score in one sentence.
Draft an intelligence report with a bottom-line-up-front summary, key judgments, supporting evidence, and an explicit confidence statement.
Identify at least three cognitive biases that affect threat analysis and describe a specific countermeasure for each.
Your checkpoint
A finished two-page threat intelligence report on a scenario of your choice, including a BLUF, at least three key judgments with confidence levels, and an ACH matrix appendix.
Threat Intelligence Dissemination and Integration & Threat Hunting and Detection
Design a dissemination matrix that assigns each product type to its audience, channel, classification marking, and delivery frequency.
Write detection logic for three ATT&CK techniques using a query language you know, and state the data source each detection depends on.
Formulate a hypothesis-driven hunt plan (hypothesis, data sources, scope, success criteria) for one technique from week 3.
Explain how intelligence feeds integrate with SIEM, EDR, and SOAR workflows, and note one failure mode for each integration.
Describe the feedback loop from detection results back into collection and requirements.
Your checkpoint
A hunt package containing a dissemination matrix, three detection rules with their required log sources, and a one-page hunt plan with explicit success criteria.
Operational Security and Threat Intelligence Program Management & Threat Intelligence Dissemination and Integration
Draft an operational security checklist covering analyst attribution risk, handling of sensitive sources, and safe infrastructure use.
Define three program-level metrics (for example, percentage of PIRs answered on time and detection coverage against prioritized techniques) and state how each is calculated.
Outline a maturity roadmap with three stages for a threat intelligence program, naming the capability gained at each stage.
Identify the legal and ethical constraints on collecting and sharing intelligence, including handling of personal data and source protection.
Your checkpoint
A program one-pager with an OPSEC checklist of at least ten items, three metrics with formulas, and a three-stage maturity roadmap.
Threat Analysis and Production & Threat Intelligence Frameworks and Standards
Produce a strategic-level assessment that translates technical findings into business risk language for an executive audience.
Re-score your week 4 report using a peer-review rubric and rewrite at least two judgments to improve precision and confidence calibration.
Map your organization's or scenario's detection coverage against the ATT&CK tactics you prioritized and identify the three largest gaps.
Reconcile conflicting reporting from two sources and document how you resolved the conflict.
Your checkpoint
A revised intelligence report plus a coverage heat map showing prioritized tactics against detected, partially detected, and undetected status.
Introduction to Threat Intelligence & Threat Intelligence Lifecycle and Planning & Operational Security and Threat Intelligence Program Management
Synthesize all prior deliverables into a single end-to-end lifecycle walkthrough from requirements to feedback.
Complete a timed practice exam or a set of at least 60 self-written review questions, and log every missed concept by domain.
Re-study your three weakest domains using the logged misses as a guide.
Write a personal post-exam plan for maintaining currency, naming at least three sources or communities to follow.
Your checkpoint
A consolidated portfolio index linking every weekly deliverable, a scored practice exam log with domain-level error counts, and a one-page maintenance plan.
Milestones
Week 2: You can explain the full intelligence lifecycle and show a collection plan in which every SIR maps to at least one source with a stated cadence and confidence.
Week 4: You have produced a finished intelligence report with a BLUF, confidence-stated judgments, and an ACH matrix, and can defend each judgment against an alternative hypothesis.
Week 6: You can state three program metrics with formulas, recite your OPSEC checklist from memory, and describe the three maturity stages without notes.
Week 8: All eight weekly deliverables are indexed, your practice log shows no domain below 70 percent, and your maintenance plan names at least three ongoing sources.