Threat Intelligence Analyst

Threat intelligence turns information about adversaries into decisions: what to detect, what to patch, and what to prepare for. This roadmap suits SOC analysts and researchers. Basic security knowledge is needed.

• Know MITRE ATT&CK basics
• Follow a few reputable threat-report sources
• Plan your study time

• CyberA4U Academy — courses

The intelligence cycle — direction, collection, processing, analysis, dissemination and feedback — keeps intel focused on what stakeholders actually need.

• Describe each phase of the cycle
• Define intelligence requirements
• Collect feedback from consumers

Tools & tech: CTI

• MITRE ATT&CK — Getting started

Intelligence comes from open sources, sharing communities, vendors and your own incidents. Each source has different reliability.

• Identify useful sources
• Rate source reliability
• Collect and store data systematically

Tools & tech: CTI

• MISP — Open source threat intelligence platform

Indicators (IPs, hashes, domains) change quickly; behaviors (techniques) change slowly. The Pyramid of Pain explains why behavioral intel is more valuable.

• Distinguish indicators from behaviors
• Prioritize durable intelligence
• Know when IOCs are still useful

Tools & tech: CTI

• David Bianco — The Pyramid of Pain

STIX is a standard format for threat intelligence; TAXII is a protocol for sharing it between systems.

• Read STIX objects
• Understand relationships between objects
• Share intelligence via TAXII

Tools & tech: CTI

• OASIS — STIX and TAXII documentation

Actor profiles describe who is behind attacks, their motives, targets and techniques — useful for prioritizing defenses.

• Build a structured actor profile
• Use MITRE ATT&CK Groups
• Avoid overconfident attribution

Tools & tech: CTI

• MITRE ATT&CK — Groups

Campaigns group related activity over time. Tracking them shows how actors evolve and whether you're targeted.

• Group related activity into campaigns
• Track changes over time
• Link campaigns to actors carefully

Tools & tech: CTI

• MITRE ATT&CK — Campaigns

Analysts pivot from one indicator to related infrastructure — domains, certificates, hosting — to uncover more of a campaign, using public data sources and professional judgment.

• Pivot on domains, IPs and certificates
• Use passive data sources responsibly
• Record your reasoning

Tools & tech: CTI

• MISP — Open source threat intelligence platform

Useful reports answer "so what?": what's happening, whether it affects us, and what we should do now.

• Lead with key judgments and actions
• Tailor to the audience
• Use confidence levels

Tools & tech: CTI

• MITRE ATT&CK — Getting started

The best test of intel is whether it improves detection. Translate techniques from reports into detection rules and hunts.

• Extract detectable behaviors from reports
• Work with detection engineers
• Track which intel produced which detection

Tools & tech: CTI

• Sigma — Rules basics

During incidents, intel helps responders understand the attacker, anticipate next steps and scope the intrusion.

• Provide context on actors and techniques
• Suggest likely next steps
• Share indicators for scoping

Tools & tech: CTI

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations

Intelligence is delivered in different forms — strategic briefs for leaders, operational reports for managers, tactical data for tools.

• Distinguish strategic, operational and tactical intel
• Choose the right format per audience
• Keep products consistent

Tools & tech: CTI

• OASIS — STIX and TAXII documentation

Measure intel by its impact: detections created, incidents shortened, patches prioritized, and stakeholder feedback.

• Define outcome-based measures
• Collect stakeholder feedback
• Report value regularly

Tools & tech: CTI

• MITRE ATT&CK Navigator

Intelligence work must respect laws, privacy and platform rules. Avoid unauthorized access and handle personal data carefully.

• Know legal limits of collection
• Protect personal data you encounter
• Follow your organization's rules of engagement

Tools & tech: CTI

• EUR-Lex — Regulation (EU) 2016/679 (GDPR)

Put everything together: pick a relevant threat, analyze it, and write a brief with key judgments, impact and recommended actions.

• Structure a full intelligence brief
• Support judgments with evidence
• Recommend concrete actions

Tools & tech: CTI

• MITRE ATT&CK — Groups

Check that you can collect, analyze and deliver intelligence that changes defensive decisions.

• Define requirements and collect
• Analyze behaviors and actors
• Produce actionable products and detections

• CyberA4U CTF Arena — practice challenges

You can now produce useful threat intelligence. Continue with Detection Engineering, Incident Response or Purple Team.

• Keep following your sources
• Choose your next roadmap
• Share a sample brief

• CyberA4U CTF Arena — practice challenges