Mile2 C)TIA study plan
Mile2 C)TIA · Give each week a clear focus.
8 weeks · About 6 hours per week
Threat Intelligence Analysis
Distinguish tactical, operational, and strategic threat intelligence and match each to a consumer (SOC analyst, IR lead, executive)
Map the intelligence cycle (direction, collection, processing, analysis, dissemination, feedback) and identify where each step can fail
Classify threat actors by motivation and capability (nation-state, organized crime, hacktivist, insider, script kiddie) using at least three real-world examples you can describe without notes
Explain the difference between an indicator, a TTP, and a campaign, and give two examples of each
Your checkpoint
A one-page intelligence-cycle diagram plus a 10-row actor table (actor type, motivation, capability, typical target, example) written entirely from memory
Threat Intelligence Analysis
Apply structured analytic techniques: analysis of competing hypotheses, key assumptions check, and red-team/devil's advocacy to a sample intrusion scenario
Deconstruct the Diamond Model and the Cyber Kill Chain, and state which questions each framework answers better
Identify cognitive biases (confirmation, anchoring, availability) and describe one mitigation for each in an analyst workflow
Write intelligence requirements and priority intelligence requirements (PIRs) for a stated business scenario
Your checkpoint
A two-page analytic product on a hypothetical intrusion that includes a completed ACH matrix, a Diamond Model diagram, and a bias self-check section
Threat Data Collection and Sources
Compare open-source, commercial, closed/community, and internal telemetry sources by cost, latency, reliability, and legal risk
Explain the difference between technical indicators, human intelligence, and finished reporting, and state when each is appropriate
Describe how to collect and normalize data from OSINT, paste sites, forums, and social media while respecting terms of service and privacy law
Identify confidence and source-reliability rating schemes (for example Admiralty-style source grading) and apply them to five sample reports
Your checkpoint
A source inventory spreadsheet of at least 15 sources with columns for type, cost, update cadence, confidence rating, and legal/ToS notes
Threat Data Collection and Sources & Threat Intelligence Platforms and Tools
Trace the indicator lifecycle from collection through enrichment, scoring, aging, and retirement
Explain indicator standards and formats: STIX/TAXII, MISP, OpenIOC, YARA, and the role of the MITRE ATT&CK knowledge base
Compare threat intelligence platform capabilities (aggregation, enrichment, correlation, dissemination, integrations) against a self-hosted versus SaaS deployment model
Evaluate the false-positive and aging problem for IPs, domains, hashes, and certificates, and propose a decay policy
Your checkpoint
A written comparison of two TIP deployment options plus a one-page indicator aging and scoring policy with concrete thresholds
Threat Intelligence Platforms and Tools
Configure a free or trial TIP or MISP instance to ingest at least one feed and tag, correlate, and export an event
Write a working YARA rule and a Sigma rule that detect a described behavior, and explain how each would be deployed
Query MITRE ATT&CK to map five observed techniques to detection opportunities and data sources
Automate one enrichment step (for example hash lookup or passive DNS) with a script or platform integration and log the result
Your checkpoint
A lab write-up with screenshots or command output showing feed ingestion, one YARA rule, one Sigma rule, and an ATT&CK technique-to-detection mapping table
Threat Intelligence Platforms and Tools & Threat Intelligence Operations and Reporting
Build a threat intelligence sharing plan that covers sharing communities, handling markings (TLP), anonymization, and legal constraints
Describe how intelligence feeds detection engineering, vulnerability management, and risk prioritization in an operational workflow
Define metrics that show intelligence program value (detection coverage, mean time to detect, false positive rate, actionable-report ratio)
Draft intelligence requirements that connect to business assets and risk appetite
Your checkpoint
A two-page threat intelligence program charter covering consumers, PIRs, sharing rules with TLP, and four program metrics with target values
Threat Intelligence Operations and Reporting
Write a finished intelligence report with a bottom line up front, confidence statements, and clear recommendations for an executive audience
Produce a tactical indicator bulletin for a SOC audience and explain how the two products differ in tone, length, and detail
Practice a verbal intelligence briefing in under five minutes and handle two challenge questions
Apply TLP markings and dissemination controls correctly to three sample products
Your checkpoint
A portfolio of three products on one scenario: an executive summary, a SOC tactical bulletin, and a five-minute briefing outline, all correctly marked
Threat Intelligence Analysis & Threat Data Collection and Sources & Threat Intelligence Platforms and Tools & Threat Intelligence Operations and Reporting
Review all four domains using a spaced-repetition pass over weak areas identified in weeks 1 through 7
Complete two timed practice exams and analyze every missed question by domain and root cause
Re-derive the intelligence cycle, key frameworks, indicator formats, and TLP rules from memory without notes
Build a one-page personal cheat sheet of facts you repeatedly miss
Your checkpoint
A scored practice exam log with per-domain accuracy, a root-cause note for each miss, and a final one-page cheat sheet
Milestones
Week 2: Can explain the intelligence cycle, name three structured analytic techniques, and diagram the Diamond Model and Kill Chain from memory without notes
Week 4: Can list at least 12 sources with their tradeoffs, describe STIX/TAXII and MISP, and state an indicator aging policy with thresholds
Week 6: Has a working lab artifact (ingested feed, YARA rule, Sigma rule, ATT&CK mapping) and can explain how intelligence feeds detection and vulnerability workflows
Week 8: Scores at least 80 percent on both timed practice exams with no domain below 70 percent, and has a completed cheat sheet of remaining weak facts