Home > Roadmap > Threat Intelligence

🕵️ Threat Intelligence Roadmap

Master the art of threat intelligence from collection and analysis to actionable intelligence and strategic decision making

Intermediate to Expert

Overview

Threat Intelligence is the process of collecting, analyzing, and disseminating information about potential or current attacks that threaten an organization. This roadmap covers the complete threat intelligence lifecycle from tactical to strategic levels.

🎯 Learning Objectives

  • Master OSINT collection techniques
  • Understand threat actor profiling
  • Develop intelligence analysis skills
  • Create actionable threat intelligence
  • Implement threat hunting strategies

🎯 Target Audience

  • Threat intelligence analysts
  • Security researchers
  • Incident responders
  • Threat hunters
  • Security managers

📋 Prerequisites

Required Knowledge

  • Basic understanding of cybersecurity concepts
  • Knowledge of threat landscape
  • Familiarity with malware analysis
  • Understanding of network protocols

🗺️ Learning Path

Phase 1: Intelligence Collection

Master the art of collecting threat intelligence from various sources.

  • OSINT Fundamentals: Open source intelligence gathering
  • Technical Intelligence: Malware, indicators, and artifacts
  • Human Intelligence: HUMINT collection methods
  • Signals Intelligence: SIGINT and communications intelligence
  • Dark Web Intelligence: Underground and hidden sources

Phase 2: Threat Actor Analysis

Develop expertise in profiling and understanding threat actors.

  • APT Groups: Advanced Persistent Threat analysis
  • Cybercriminal Organizations: Organized crime profiling
  • Nation-State Actors: State-sponsored threat analysis
  • Hacktivists: Ideologically motivated groups
  • Insider Threats: Internal threat assessment

Phase 3: Intelligence Analysis

Master analytical frameworks and intelligence processing.

  • Intelligence Cycle: Direction, collection, processing, dissemination
  • Analytical Frameworks: Diamond Model, Kill Chain, MITRE ATT&CK
  • Threat Modeling: Risk assessment and threat modeling
  • Indicators of Compromise: IOCs and threat indicators
  • Pattern Recognition: Identifying attack patterns and trends

Phase 4: Intelligence Operations

Implement threat intelligence in operational environments.

  • Threat Hunting: Proactive threat detection
  • Intelligence Fusion: Multi-source intelligence integration
  • Threat Intelligence Platforms: TIP implementation and management
  • Strategic Intelligence: Executive-level threat briefings
  • Intelligence Sharing: Collaborative threat intelligence

🛠️ Essential Tools

OSINT Tools

  • Maltego: Intelligence gathering platform
  • Shodan: Internet-connected device search
  • theHarvester: Email, subdomain, and port scanning
  • Recon-ng: Web reconnaissance framework
  • SpiderFoot: OSINT automation platform

Malware Analysis

  • YARA: Pattern matching and malware identification
  • Cuckoo Sandbox: Automated malware analysis
  • VirusTotal: Multi-engine malware scanning
  • Hybrid Analysis: Malware analysis platform
  • CAPE: Malware configuration extraction

Threat Intelligence Platforms

  • MISP: Open source threat intelligence platform
  • ThreatConnect: Commercial threat intelligence platform
  • Anomali: Threat intelligence and analytics
  • Recorded Future: Threat intelligence platform
  • IBM X-Force: Threat intelligence and research

Analysis Tools

  • MITRE ATT&CK Navigator: Attack technique mapping
  • STIX/TAXII: Threat intelligence standards
  • Ghidra: Reverse engineering framework
  • IDA Pro: Interactive disassembler
  • Jupyter Notebooks: Data analysis and visualization

📊 Intelligence Types

Tactical Intelligence

  • IOCs and threat indicators
  • Malware signatures and hashes
  • Network indicators (IPs, domains)
  • File artifacts and registry keys
  • Behavioral indicators

Operational Intelligence

  • Attack techniques and procedures
  • Campaign analysis and attribution
  • Threat actor motivations
  • Infrastructure and tooling
  • Timeline and correlation

Strategic Intelligence

  • Long-term threat trends
  • Geopolitical implications
  • Industry-specific threats
  • Risk assessments
  • Executive briefings

Technical Intelligence

  • Vulnerability intelligence
  • Exploit development trends
  • Security technology gaps
  • Defense evasion techniques
  • Emerging attack vectors

📚 Learning Resources

📖 Books

  • Intelligence-Driven Incident Response
  • Threat Hunting with Elastic Stack
  • Applied Incident Response
  • Cyber Threat Intelligence

🎓 Courses

  • SANS FOR578: Cyber Threat Intelligence
  • SANS FOR508: Advanced Digital Forensics
  • SANS FOR572: Advanced Network Forensics
  • OSINT Fundamentals

🌐 Online Platforms

  • MITRE ATT&CK Framework
  • VirusTotal Intelligence
  • ThreatConnect Community
  • MISP Community

📄 Standards & Frameworks

  • STIX/TAXII Standards
  • IOC Format Standards
  • NIST Cybersecurity Framework
  • ISO 27001 Intelligence

🏆 Certifications

GCTI

GIAC Cyber Threat Intelligence

Advanced

GCFA

GIAC Certified Forensic Analyst

Advanced

GREM

GIAC Reverse Engineering Malware

Expert

OSCP

Offensive Security Certified Professional

Advanced

🎯 Hands-On Labs

Lab 1: OSINT Collection

Objective: Master open source intelligence gathering techniques

  1. Set up OSINT collection tools and frameworks
  2. Perform domain and subdomain enumeration
  3. Conduct email and username reconnaissance
  4. Analyze social media and public information
  5. Create intelligence collection reports

Lab 2: Threat Actor Profiling

Objective: Develop threat actor analysis and profiling skills

  1. Research and profile known APT groups
  2. Analyze attack techniques and procedures
  3. Map threat actors to MITRE ATT&CK framework
  4. Create threat actor intelligence reports
  5. Develop attribution methodologies

Lab 3: Malware Intelligence

Objective: Extract intelligence from malware samples

  1. Set up malware analysis environment
  2. Perform static and dynamic analysis
  3. Extract IOCs and threat indicators
  4. Create YARA rules for detection
  5. Generate malware intelligence reports

Lab 4: Threat Hunting

Objective: Implement proactive threat hunting techniques

  1. Develop threat hunting hypotheses
  2. Create hunting queries and rules
  3. Analyze network and endpoint data
  4. Investigate suspicious activities
  5. Document hunting findings and lessons learned

Lab 5: Intelligence Platform Implementation

Objective: Deploy and manage threat intelligence platform

  1. Set up MISP threat intelligence platform
  2. Configure data feeds and integrations
  3. Create intelligence sharing workflows
  4. Implement STIX/TAXII standards
  5. Develop intelligence dissemination procedures

💡 Best Practices

Threat Intelligence Checklist

  • ✅ Establish clear intelligence requirements
  • ✅ Implement multi-source intelligence collection
  • ✅ Use standardized frameworks and methodologies
  • ✅ Maintain threat actor and campaign databases
  • ✅ Create actionable and timely intelligence
  • ✅ Implement intelligence sharing partnerships
  • ✅ Regularly update threat landscape assessments
  • ✅ Measure intelligence effectiveness and ROI
  • ✅ Ensure legal and ethical compliance
  • ✅ Continuously improve analytical capabilities

🔗 Related Roadmaps

Reconnaissance Malware Analysis Incident Response Red Team Operations SIGINT

📧 Stay Updated with New Roadmaps

Get notified when we add new cybersecurity roadmaps and expert content!

← Back to Roadmap