Threat Intelligence (CTI)

Overview

Threat intelligence answers questions about attackers: who is likely to target us, what do they want, how do they operate, and what should we do about it? Analysts collect information from incidents, open sources, sharing groups and vendors, analyse it, and deliver it to the people who need it.

Intelligence comes at three levels: strategic (for leaders, about trends and risk), operational (about campaigns and actors) and tactical (indicators and techniques for the SOC). Good CTI starts from what its customers need to decide, not from the data that happens to be available.

Why it matters

Every security team has limited time. Intelligence tells it which threats matter most, which vulnerabilities to patch first and which detections to build. CTI analysts work in companies, governments, vendors and sharing centres.

Typical job roles

• EntryJunior CTI analyst Collects and enriches indicators, tracks reports and writes short summaries.
• Mid-levelCTI analyst Tracks actors and campaigns and produces intelligence for the SOC and IR teams.
• Mid-levelStrategic intelligence analyst Writes threat assessments and briefings for leaders.
• SeniorSenior CTI analyst Leads analysis of advanced actors and sets collection priorities.
• LeadHead of threat intelligence Runs the CTI programme and its relationships with partners.

Prerequisites

• Security Operations beginner stage and a basic understanding of how attacks work.
• Clear writing for different audiences.
• Networking basics: IP addresses, domains, DNS and certificates.
• Curiosity and patience for research.

Cybersecurity

Tools and technologies

• MISP Open source Threat intelligence sharing platform.
• OpenCTI Open source Platform to store and link intelligence with STIX.
• ATT&CK Navigator Open source Map and compare actor techniques.
• VirusTotal Free community edition File, URL and domain reputation and relationships.
• Certificate Transparency logs Free Monitor certificate issuance for your domains.
• CyberChef Open source Decode and transform data.
• Maltego Community Edition Free community edition Link analysis and pivoting.

Certifications

Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.

1. Advanced GIAC Cyber Threat Intelligence (GCTI) GIACThe best-known CTI certification.
2. Intermediate CySA+ (Cybersecurity Analyst) CompTIACovers threat intelligence basics.Cost and exam details
3. Entry Security+ CompTIAA common baseline.Cost and exam details

Resources

• MITRE ATT&CK DocsFreeMITRE
• STIX and TAXII documentation DocsFreeOASIS Open
• Psychology of Intelligence Analysis BookFreeRichards J. Heuer Jr. (CIA)
• Intelligence-Driven Incident Response BookPaidRebekah Brown and Scott J. Roberts (O'Reilly)
• Data Breach Investigations Report DocsFreeVerizon
• The DFIR Report DocsFreeThe DFIR Report
• FOR578: Cyber Threat Intelligence CoursePaidSANS Institute

Frameworks and standards

• MITRE ATT&CK A knowledge base of real attacker tactics and techniques, used to plan detections, hunts and red team work.
• Cyber Kill Chain Seven stages of an intrusion, from reconnaissance to actions on objectives, used to plan where to detect and disrupt attacks.
• The Diamond Model of Intrusion Analysis Describes every intrusion event by adversary, capability, infrastructure and victim, so analysts can pivot between them.
• STIX and TAXII The standard language (STIX) and transport (TAXII) for sharing cyber threat intelligence between tools and organisations.
• Traffic Light Protocol (TLP) Four labels that say how widely a piece of shared information may be passed on.
• CISA Known Exploited Vulnerabilities (KEV) catalog The list of vulnerabilities known to be exploited in the wild; a practical guide to what to patch first.

All frameworks and standards

Career path

A common progression. Titles vary between companies.

1. SOC analyst, journalist, researcher or analyst in another field0–2 years
2. Junior CTI analyst1–3 years
3. CTI analyst3–6 years
4. Senior CTI analyst6–9 years
5. Head of threat intelligence10+ years

Related domains to move into

• Threat Hunting Intelligence becomes hunts.
• Detection Engineering Intelligence decides which detections to build first.
• Digital Forensics and Incident Response (DFIR) Incidents are your best source of intelligence.
• Malware Analysis and Reverse Engineering Samples reveal what actors can do.