Description

This curriculum spans the design and operation of a corporate threat intelligence function, comparable in scope to a multi-phase advisory engagement that integrates with existing security operations, risk management, and compliance programs across an enterprise.

Module 1: Establishing a Threat Intelligence Program Framework

Define intelligence requirements by aligning with business units to prioritize threats relevant to corporate assets, such as intellectual property or customer data.
Select between centralized, decentralized, or hybrid intelligence team structures based on organizational size and existing security operations maturity.
Develop a formal charter that outlines the program’s scope, authority, and interaction protocols with incident response, IT, and legal teams.
Implement a classification schema for intelligence products to ensure consistent handling, storage, and dissemination across departments.
Integrate threat intelligence objectives into the organization’s broader risk management framework to support executive decision-making.
Establish metrics such as time-to-integrate intelligence or reduction in dwell time to measure program effectiveness without over-relying on vanity metrics.

Module 2: Sourcing and Evaluating Intelligence Feeds

Conduct technical and legal assessments of commercial threat feed providers to validate data freshness, coverage, and acceptable use terms.
Configure automated validation pipelines to parse, normalize, and de-duplicate indicators from multiple open-source, commercial, and ISAC feeds.
Implement a scoring system to rate feed reliability based on historical accuracy and timeliness of actionable alerts.
Negotiate data-sharing agreements with peer organizations while ensuring compliance with antitrust and privacy regulations.
Filter out irrelevant or low-fidelity intelligence (e.g., botnet IPs in non-exposed networks) to reduce analyst fatigue and system load.
Monitor for feed degradation by tracking drop-offs in volume or changes in source behavior that may indicate compromised collection methods.

Module 3: Threat Actor Profiling and Attribution Analysis

Map observed tactics, techniques, and procedures (TTPs) to known adversary groups using frameworks like MITRE ATT&CK without jumping to premature attribution.
Correlate infrastructure overlaps (e.g., shared C2 servers or domain registrars) across incidents to identify persistent threat campaigns.
Balance the need for attribution with operational security by limiting disclosure of sensitive collection methods during internal reporting.
Assess geopolitical context when evaluating state-sponsored actor activity, especially during periods of international tension.
Document confidence levels for attribution claims using structured analytic techniques to prevent cognitive bias.
Coordinate with external partners or law enforcement only after internal legal review and risk assessment of information sharing.

Module 4: Integration with Security Operations and Tooling

Deploy STIX/TAXII-compliant parsers to ingest structured intelligence into SIEM, EDR, and firewall systems at scale.
Configure automated blocking rules for high-confidence indicators while implementing time-bound overrides to prevent overblocking.
Map intelligence-derived TTPs to detection rules in endpoint and network monitoring tools to improve coverage of lateral movement and persistence.
Adjust correlation thresholds in SOAR platforms to reduce false positives when enriching alerts with threat context.
Validate integration success by measuring the percentage of escalated incidents that include relevant threat intelligence context.
Establish feedback loops from SOC analysts to refine intelligence prioritization based on operational utility.

Module 5: Production of Actionable Intelligence Reports

Structure reports using the Production Cycle (planning, collection, processing, analysis, dissemination) to maintain consistency.
Tailor report formats for different audiences—technical teams receive indicator lists, executives receive risk summaries.
Use confidence statements (e.g., “moderate confidence”) and source attribution in assessments to support informed decision-making.
Apply red-teaming techniques to challenge key assumptions in intelligence assessments before dissemination.
Archive reports with metadata (e.g., author, date, classification) to support auditability and historical analysis.
Implement version control for ongoing threat assessments to track evolving understanding of campaigns.

Module 6: Threat Hunting Using Intelligence Inputs

Develop hypothesis-driven hunt plans based on newly received intelligence about emerging TTPs in the sector.
Query endpoint and network logs for stealthy behaviors such as DCShadow or DCSync activity following credential access alerts.
Use intelligence on attacker infrastructure to search for beaconing patterns or DNS tunneling in proxy and firewall logs.
Coordinate hunting activities with blue team members to avoid disrupting production systems during data collection.
Document and triage findings using a standardized format that enables integration into the case management system.
Measure hunt effectiveness by the percentage of investigations that result in confirmed malicious activity or new detection rules.

Module 7: Legal, Ethical, and Privacy Constraints

Consult legal counsel before collecting or acting on intelligence involving third-party systems or personal data.
Implement data retention policies that align with jurisdictional privacy laws such as GDPR or CCPA for stored indicators.
Restrict access to sensitive intelligence sources to authorized personnel using role-based access controls.
Audit intelligence usage to ensure compliance with internal policies and external regulatory obligations.
Assess risks of counterintelligence when engaging in active collection or attribution, particularly against sophisticated adversaries.
Establish protocols for handling intelligence that implicates insiders, ensuring alignment with HR and legal procedures.

Module 8: Maturity Assessment and Continuous Improvement

Conduct biannual gap analyses comparing current capabilities against industry benchmarks such as NIST or MITRE D3FEND.
Perform tabletop exercises simulating targeted attacks to test intelligence responsiveness and cross-team coordination.
Review false negative incidents to determine whether available intelligence was overlooked or improperly integrated.
Update collection priorities based on shifts in business operations, such as cloud migration or M&A activity.
Rotate analyst responsibilities periodically to prevent stagnation and encourage cross-functional skill development.
Institutionalize lessons learned by updating standard operating procedures after major incidents or intelligence successes.