Threat Intelligence

Strategic, operational, tactical, technical TI — and how to make it actionable

A practical track on producing, consuming, and operationalizing threat intelligence. Distinct from incident response (post-event) and threat hunting (active search) — TI is the strategic layer that informs both. Distinguish strategic/operational/tactical/technical TI, produce IOCs and TTPs that are actually actionable, run MISP and OpenCTI, apply Diamond Model + Cyber Kill Chain, write threat-actor profiles that inform detection priorities, avoid attribution mistakes.

Lessons

• TI Levels
• IOCs: Types, Lifecycle, Sharing Standards
• TTPs and the MITRE ATT&CK Framework
• Models: Diamond, Kill Chain, Pyramid of Pain
• TI Platforms: MISP, OpenCTI, ThreatConnect
• Threat Actor Profiling and Attribution
• Producing Client Deliverables
• Capstone: Profile a Real APT and Present