Threat Intelligence Lab

Defend your infrastructure with intelligence.

Your trusted Threat Intelligence partner

Explore courses View exams
Manticore Manticore Close Up
0
Exams Passed
Services

Practical support from learning plan to outcome.

Elevate your security posture with our tailored threat intelligence solutions.

Threat Hunting

AI Automation

Streamline your workflows and security operations with intelligent automation.

Threat Hunting

Proactive identification and mitigation of advanced persistent threats within your network.

Incident Response

Rapid analysis, containment, and eradication of active security breaches.

Vulnerability Assessments

Comprehensive evaluation of your infrastructure to identify and prioritize security weaknesses.

Security Training

Empower your team with hands-on training against the latest cyber threats.

Learning Path

Expand your expertise.

Dive into our comprehensive courses designed to build your knowledge.

Browse all courses
DNS InvestigationsClient identity, recursive resolution, record context, time, and corroborating telemetry turn queries into defensible decisions.PRACTICAL SECURITY OPERATIONSDNS InvestigationsClientResolverRecordsCorroborationResolutionEVIDENCE → REASONING → DEFENSIBLE ACTION
intermediate Network Security Analysis

DNS Investigations: Resolution, Telemetry, and Threat Decisions

A practical analyst course for tracing DNS resolution, reading records and caches, working with resolver telemetry, and turning suspicious queries into scoped security decisions.

3 Modules View Course →
Endpoint Process-Tree AnalysisLineage, command intent, endpoint changes, connections, identity, and baseline combine into a behavior decision.PRACTICAL SECURITY OPERATIONSEndpoint Process-Tree AnalysisLineageArgumentsBehaviorImpactEVIDENCE → REASONING → DEFENSIBLE ACTION
intermediate Endpoint Security Analysis

Endpoint Process-Tree Analysis: From Alert to Behavior

A practical course for reconstructing Windows execution, reading command lines, separating signed tools from trusted behavior, and correlating process trees with endpoint impact.

3 Modules View Course →
Phishing Email TriageAn evidence path connects message preservation, authentication, content analysis, scoping, and containment.PRACTICAL SECURITY OPERATIONSPhishing Email TriageMessageIdentityContentScopeEVIDENCE → REASONING → DEFENSIBLE ACTION
intermediate Security Operations

Phishing Email Triage: From Message Evidence to Containment

A hands-on analyst course for examining suspicious email safely, interpreting authentication and routing evidence, scoping exposure, and recording a defensible disposition.

3 Modules View Course →
Exam

Assess your knowledge.

Test your skills and prove your expertise with our rigorous certification exams.

Browse all exams
40 min 6 questions 6 points

AA23-108 APT28 Router Exploitation Analysis

Research how APT28 used weak SNMP configuration and a known Cisco vulnerability to enumerate routers, deploy Jaguar Tooth, collect network data, and maintain covert access.

50 min 6 questions 6 points

AA23-129A Snake Implant Architecture

Examine the Snake implant's Windows persistence, encrypted artifacts, Queue structure, modular protocol stack, layered encryption, and global peer-to-peer relay design.

45 min 6 questions 6 points

AA23-136A BianLian Intrusion Tradecraft

Research BianLian's access, proxying, privilege escalation, discovery, credential theft, defense evasion, and changing extortion model from the joint advisory.

Resource library

Explore threat intelligence topics.

Browse practical guides by the problem you want to solve.

Browse all resources
11 resources CTI Analysis & Tradecraft 8 resources CTI Careers & Industry 8 resources CTI Fundamentals 7 resources CTI Collection & Sources 7 resources CTI Program Management 6 resources CTI Technology & Platforms 6 resources Strategic CTI 6 resources Vulnerability Intelligence 5 resources CTI Sharing & Standards