FREE COURSE / SELF-PACED LEARNING

Operational Cyber Threat Intelligence: Investigations, Campaigns, and Defensive Action

Develop timelines, investigate campaign hypotheses and brief defensive options in this free operational CTI course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
6 modules · 12 lessons
Estimated reading
3 hr 51 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Translate an operational security decision into scoped intelligence requirements, priority information needs, collection tasks, and explicit review triggers.
  • Construct evidence timelines that preserve provenance, distinguish event time from knowledge time, expose visibility gaps, and support incident-scoping decisions.
  • Analyze adversary infrastructure and behavior without overstating identity, independence, persistence, prevalence, or maliciousness.
  • Define, test, and revise campaign hypotheses using discriminating evidence, confidence judgments, alternative explanations, and change conditions.
  • Produce operational assessments and briefings that communicate current scope, likely next actions, defensive opportunities, uncertainty, and update triggers.
  • Convert intelligence into bounded hunting, detection, containment, and remediation options, then measure operational use, outcomes, and learning.

Is this the right course for you?

Who it’s for

Practitioners familiar with CTI foundations who support investigations and security operations.

Scope and boundaries

Operational investigations and time-sensitive defensive action. Strategic CTI addresses longer-term executive and investment decisions.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Cyber Threat Intelligence foundations — Learners should understand intelligence requirements, source and evidence evaluation, uncertainty, behavior-centered analysis, intelligence writing, and responsible dissemination. Completing Cyber Threat Intelligence Foundations: From Evidence to Decision or possessing equivalent knowledge is recommended.

About this course

An intermediate, vendor-neutral course for cyber threat intelligence analysts, incident responders, threat hunters, detection engineers, and security operations professionals. Learners practice translating operational decisions into investigation plans, constructing defensible evidence timelines, analyzing infrastructure and identity relationships, testing campaign hypotheses, producing time-sensitive intelligence assessments, and converting analytic judgments into hunts, detections, containment options, and measurable improvement. The course emphasizes provenance, uncertainty, alternative explanations, responsible handling, clear handoffs, and feedback-driven defensive operations through the fictional Project Lantern scenario.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. Operational Direction and Investigation Design

Frame active security problems as decision-centered intelligence work, establish coordination and review rhythms, and design bounded investigations that can adapt as evidence changes.

  1. Scoping Operational Intelligence RequirementsTurn an active security concern into bounded, prioritized requirements that support specific operational decisions under time pressure.22 min reading
  2. Designing the Investigation and Coordination RhythmBuild an adaptable investigation plan with explicit roles, evidence priorities, review gates, update cadences, escalation paths, and stopping conditions.21 min reading

MODULE 2

2. Evidence Timelines and Incident Reconstruction

Reconstruct activity across endpoint, identity, email, network, cloud, and human evidence while preserving provenance, multiple time concepts, uncertainty, gaps, and defender-generated changes.

  1. Building a Defensible Evidence TimelineReconstruct events across multiple evidence sources while preserving provenance, timestamp meaning, transformations, uncertainty, and defender actions.20 min reading
  2. Reconstructing Scope, Sequence, and Alternative ExplanationsUse timelines, entity relationships, negative evidence, and visibility analysis to estimate incident scope and compare plausible reconstructions.20 min reading

MODULE 3

3. Infrastructure, Identity, and Relationship Analysis

Analyze domains, addresses, certificates, hosting, accounts, tools, and other relationships as time-bounded evidence while distinguishing shared infrastructure, reuse, coincidence, coordination, and identity claims.

  1. Analyzing Adversary Infrastructure in Time and ContextEvaluate domains, addresses, certificates, hosting, registration, and service relationships as volatile, time-bounded evidence rather than permanent malicious identities.19 min reading
  2. Identity, Tooling, and Relationship HypothesesAnalyze accounts, personas, code, tools, language, infrastructure, and operational patterns without turning association into identity or attribution.21 min reading

MODULE 4

4. Campaign Analysis and Adversary Behavior

Determine when related observations support a campaign hypothesis, model behavior across incidents and time, compare alternative explanations, and identify likely objectives, changes, and defensive opportunities without forcing attribution.

  1. Defining and Testing a Campaign HypothesisDetermine whether related observations represent one campaign, several operations, copied behavior, shared services, or coincidental overlap.20 min reading
  2. Modeling Campaign Evolution and Defensive OpportunitiesTrack how adversary behavior, infrastructure, targeting, timing, and defensive reactions change across a campaign.20 min reading

MODULE 5

5. Operational Assessments and Intelligence Updates

Produce time-sensitive assessments that communicate current scope, leading explanations, likely next actions, confidence, alternatives, warning indicators, defensive opportunities, and clearly versioned updates.

  1. Writing the Operational Intelligence AssessmentWrite a time-sensitive assessment that communicates current scope, leading explanations, likely next actions, confidence, alternatives, and decision implications.19 min reading
  2. Briefing, Updating, and Correcting Under Time PressureDeliver preliminary judgments responsibly, manage versions and information cutoffs, incorporate challenge, and correct operational intelligence without obscuring change.16 min reading

MODULE 6

6. From Intelligence to Defensive Operations

Translate operational intelligence into bounded hunts, detections, containment and remediation choices, build feedback into handoffs, and measure whether the work improved decisions and defensive outcomes.

  1. Designing Intelligence-Led Hunts and DetectionsTranslate campaign and behavior judgments into testable hunt hypotheses and detection analytics with explicit evidence, coverage, limitations, and lifecycle controls.18 min reading
  2. Operational Handoffs, Outcomes, and LearningTurn intelligence into accountable containment and remediation options, preserve context through handoffs, and measure decision use, operational results, and durable improvement.15 min reading

TAKE THE NEXT DECISION

Practise with a mission

Missions are separate interactive investigations. Review the campaign’s scope and access requirements before starting.

The Lantern Protocol

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.