CTI Fundamentals
This section introduces the core concepts of Cyber Threat Intelligence (CTI). Explore the CTI Life Cycle to understand the end-to-end process, and discover the primary objectives that drive a successful intelligence program. These fundamentals provide the foundation for all subsequent analysis and operations.
The CTI Life Cycle
1. Planning & Direction
2. Collection
3. Processing
4. Analysis & Production
5. Dissemination
6. Feedback
Planning & Direction
Defines intelligence requirements based on organizational goals. This initial phase sets the scope, objectives, and direction for the entire intelligence effort, ensuring that the CTI program addresses key stakeholder concerns and risks.
Core CTI Program Objectives
Support Real-Time Security Operations
Provide timely, actionable indicators (IOCs) and context to the Security Operations Center (SOC) to help detect and respond to threats as they happen.
Facilitate Effective Incident Response
Enrich incident investigations by providing deep insights into adversary tactics, techniques, and procedures (TTPs), helping IR teams understand the "who, what, and how" of an attack.
Enable Proactive Threat Hunting
Move beyond reactive alerting by creating hypotheses based on adversary TTPs and proactively searching for signs of compromise within the environment.
Inform Security Governance & Strategy
Provide strategic intelligence to leadership to inform risk management, security investments, policy updates, and overall defensive posture.
Frameworks & Models
Frameworks provide the structure needed for effective analysis and communication. This section allows you to compare the most influential models in CTI: Lockheed Martin's Cyber Kill Chain, the MITRE ATT&CK® framework, the Diamond Model of Intrusion Analysis, and the Pyramid of Pain. Understanding these is key to deconstructing adversary actions.
Lockheed Martin Cyber Kill Chain
A sequential model that outlines the typical stages of a cyberattack. By understanding these phases, defenders can identify opportunities to detect, deny, or disrupt adversary operations at each step.
The Analyst's Toolkit
This section covers the practical resources an analyst uses daily. It explores the different types of data sources, from internal logs to commercial feeds, the platforms used to manage this data like SIEMs and TIPs, and the common formats used to share intelligence, such as YARA rules.
Comparing Threat Data Sources
Key Platforms
-
SIEM (Security Information and Event Management)
Aggregates and correlates log data from across the enterprise. CTI integration enriches SIEM alerts with external context, turning simple events into high-fidelity incidents.
-
TIP (Threat Intelligence Platform)
A specialized platform for collecting, normalizing, enriching, and disseminating threat intelligence from multiple sources. It serves as the central brain for CTI operations.
Key Sharing Formats
-
STIX/TAXII
The standard for sharing structured threat information. STIX defines the "what" (indicators, TTPs), and TAXII defines the "how" (the transport protocol).
-
YARA
A tool to help malware researchers identify and classify malware samples. YARA rules are like a "search" language for finding patterns in files, making them an effective way to share malware IOCs.
Advanced Concepts & Integration
Go beyond the fundamentals with advanced topics. This section covers strategic threat modeling, the dual-use nature of AI in cybersecurity, and how to embed CTI into modern development processes like DevSecOps to build security in from the start.
Strategic Threat Modeling
A proactive process to identify threats, vulnerabilities, and countermeasures early in the system design phase. Methodologies like STRIDE help systematically analyze potential security risks before they can be exploited. It asks "what could go wrong?" and "how can we prepare?".
AI in Cybersecurity
AI is a double-edged sword. Defenders use it for anomaly detection and automated analysis at scale. Adversaries leverage it to create evasive malware and conduct sophisticated phishing campaigns. Understanding both sides is crucial for future defense.
Integrating CTI into DevSecOps
Embedding threat intelligence into the software development lifecycle ensures security is a continuous process, not an afterthought. Click each stage to see how CTI adds value.
Plan
Code
Build
Test
Release
Deploy
Operate
Click a stage icon above to see how CTI applies.