Make no mistake: current network defence, threat hunting, and incident response practices contain a strong element of intelligence and counter intelligence that cyber analysts must understand and leverage in order to defend their networks, proprietary data, and organizations. Using Cyber Range, the abilities to emulate and simulate targeted attack, an organization needs a top-notch and cutting-edge threat hunting or incident response team armed with the threat intelligence necessary to understand how adversaries operate and to counter the threat. This course will train you and your team in the tactical, operational, and strategic level cyber threat intelligence skills and tradecraft required to make security teams better, threat hunting more accurate, incident response more effective, and organizations more aware of the evolving threat landscape.

This course will help network defenders, threat hunting teams, and incident responders to:

  • Understand and develop skills in tactical, operational, and strategic level threat intelligence
  • Generate threat intelligence to detect, respond to, and defeat advanced persistent threats (APTs)
  • Validate information received from other organizations to minimize resource expenditures on bad intelligence
  • Leverage open-source intelligence to complement a security team of any size
  • Hunting Indicators of Compromise (IOCs)

Tactical threat intelligence requires that analysts extract and categorize indicators and adversary tradecraft from intrusions. These actions enable all other levels of threat intelligence by basing intelligence on observations and facts that are relevant to the organization. One of the most commonly used models for assessing adversary intrusions is the “kill chain.” This model is a framework to understand the steps an adversary must accomplish to be successful. This section will help tactical threat intelligence develop the skills required to be successful by using the kill chain as a guide. Students will then pivot into open-source intelligence gathering tradecraft to enrich their understanding of the analyzed intrusion.