CTSP study plan

Define the intelligence cycle and map each of its six stages to a concrete CTI workflow you could run in a small security team

Compare the main analytic frameworks (kill chain, MITRE ATT&CK, Diamond Model, Pyramid of Pain) and state in writing which question each one answers best

Distinguish tactical, operational, and strategic intelligence and give two realistic consumers for each tier

Explain confidence levels, sourcing, and the difference between data, information, and intelligence using your own examples

Classify threat actors into commodity crime, organized crime, hacktivism, insider, and state-sponsored categories with distinguishing behaviors for each

Describe the motivations, resourcing, and targeting patterns that separate nation-state espionage from financially motivated intrusion

Trace at least three named intrusion sets through ATT&CK group pages and record their preferred initial access and persistence techniques

Explain sector-specific targeting trends for at least three industries and the reasoning behind them

Build a collection plan template that starts from priority intelligence requirements rather than from available feeds

Evaluate at least six source types (OSINT, commercial feeds, ISAC sharing, malware sandboxes, dark web, internal telemetry) on reliability, timeliness, and cost

Apply the Admiralty source reliability and information credibility grading scheme to ten sample reports

Identify legal and sharing constraints that limit what each source can be redistributed

Apply at least five structured analytic techniques (ACH, key assumptions check, devil's advocacy, what-if analysis, indicators of change) to a sample intrusion scenario

Demonstrate how to mitigate at least four cognitive biases including anchoring, confirmation, and availability bias

Draft intelligence requirements that are specific, answerable, and tied to a decision the stakeholder must make

Write a confidence statement that separates what is known, what is inferred, and what is assumed

Differentiate IOCs by durability (hash, IP, domain, behavioral TTP) and rank them by cost to the adversary

Write at least three Sigma rules and two YARA rules that detect behavior rather than a single artifact

Design a hypothesis-driven threat hunt from a PIR through data source selection to detection validation

Explain IOC lifecycle, decay, false positive management, and enrichment before operational use

Compare TIP, SIEM, SOAR, and MISP capabilities and state which problem each one solves

Configure a small MISP instance or equivalent lab and ingest, tag, and correlate at least twenty indicators

Automate one enrichment or indicator-to-detection pipeline end to end and document its failure modes

Evaluate a platform against requirements covering data model, integrations, sharing, and access control

Tailor the same finding for a SOC analyst, a CISO, and a business owner, adjusting depth, jargon, and decision framing

Structure a threat report using a BLUF (bottom line up front) format with key judgments, confidence, and recommended actions

Write dissemination rules that define audience, classification, handling caveats, and feedback loop

Deliver a five-minute verbal briefing without notes and handle two challenging follow-up questions

Apply legal constraints on collection, handling, and sharing including privacy, data protection, and terms of service for OSINT sources

Identify operational security failures in a threat intelligence workflow and design controls to prevent analyst attribution or exposure

Explain ethical obligations around handling victim data, disclosure coordination, and responsible sharing

Run a full timed practice exam and review every missed item against its source domain