Incident Response
First Response to an Account, Device, or Data Compromise
Take calm, prioritized action after suspicious access, malware, device loss, or data exposure while preserving trustworthy recovery options.
Knowledge hub
Threat intelligence resources
Find practical guides for building CTI capability, improving analysis, developing your career, and turning intelligence into action.
Browse
Browse by topic
Choose a topic to see its complete collection.
11 resources
CTI Analysis & Tradecraft
Practical methods for evaluating evidence and producing defensible Cyber Threat Intelligence judgments.
10 resources
CTI Collection & Sources
Practical guidance for cti collection & sources decisions and defensible security work.
8 resources
CTI Careers & Industry
Practical guidance for building, choosing, and progressing through Cyber Threat Intelligence careers.
8 resources
CTI Fundamentals
Clear, practical explanations of the core concepts, methods, evidence, and applications of Cyber Threat Intelligence.
7 resources
CTI Program Management
Practical guidance for designing, governing, measuring, and improving Cyber Threat Intelligence capabilities.
7 resources
Identity & Access Security
Practical guidance for identity, authentication, authorization, and accountable access.
7 resources
Vulnerability Intelligence
Practical guidance for vulnerability intelligence decisions and defensible security work.
6 resources
CTI Technology & Platforms
Practical guidance for selecting, integrating, and governing technology used in Cyber Threat Intelligence.
6 resources
Strategic CTI
Cyber Threat Intelligence for leadership, business risk, planning, and long-horizon decisions.
5 resources
CTI Sharing & Standards
Practical guidance for sharing Cyber Threat Intelligence with clear formats, handling, trust, and governance.
5 resources
Microsoft Purview
Practical guidance for Microsoft Purview Information Protection, data classification, governance, compliance, and data security controls.
4 resources
Incident Response
Practical guidance for investigating, containing, recovering from, and learning from security incidents.
3 resources
Detection Engineering
Practical guidance for designing, testing, deploying, and maintaining security detections.
3 resources
Network Security
Practical guidance for understanding and protecting networked activity and evidence.
3 resources
Security Awareness
Practical guidance that helps people make safer decisions during security-sensitive work.
3 resources
Security Operations
Practical guidance for security operations decisions and defensible security work.
3 resources
Software Supply Chain Security
Practical guidance for protecting source, builds, dependencies, artifacts, and delivery systems.
1 resource
Cloud Security
Practical guidance for cloud security decisions and defensible security work.
1 resource
Cybersecurity Fundamentals
Clear, practical explanations of foundational cybersecurity ideas and safer digital habits.
1 resource
Data Security
Practical guidance for protecting information throughout collection, use, sharing, storage, and recovery.
1 resource
Endpoint Security
Practical guidance for protecting and investigating devices where people and applications work.
Library
All resources
Newest resources are shown first.
Data Security
Personal Data, Privacy, Sharing, and Backups
Reduce unnecessary data exposure, share deliberately, manage permissions and retention, and maintain backups that can actually restore what matters.
Network Security
Safer Wi-Fi, Browsing, Downloads, and Apps
Use modern connection security, trustworthy destinations, careful downloads, and bounded app permissions without relying on security myths.
Endpoint Security
Securing Everyday Devices: Updates, Apps, and Device Loss
Protect phones, laptops, tablets, and smart devices through supported software, trusted apps, secure configuration, encryption, and loss preparation.
Cybersecurity Fundamentals
Cybersecurity Risk in Everyday Life
Use assets, threats, vulnerabilities, likelihood, impact, and defense in depth to make practical everyday security decisions.
Detection Engineering
Detection Validation With Simulations and Known-Good Data
Test telemetry, logic, enrichment, alert delivery, and analyst outcomes with safe, repeatable malicious and benign scenarios.
Software Supply Chain Security
Secrets Management for Development and CI/CD
Control credentials across source, build, deployment, and runtime with scoped identities, short lifetimes, safe injection, monitoring, and rehearsed rotation.
Incident Response
Ransomware Containment, Recovery, and Extortion Decisions
Coordinate isolation, evidence, identity containment, business continuity, restoration, and extortion decisions during a ransomware incident.
Security Awareness
Business Email Compromise and Payment-Change Verification
Recognize impersonation and mailbox compromise, verify sensitive requests independently, and coordinate fast action after a fraudulent payment.
Identity & Access Security
Password Managers, Credential Reuse, and Breach Response
Use unique credentials safely, protect password vaults, recognize credential stuffing, and respond proportionately when passwords may be exposed.
Identity & Access Security
OAuth Consent and Connected Applications: Safe Delegated Access
Understand delegated access, consent grants, scopes, tokens, connected-app risk, and the evidence needed to investigate or revoke access safely.
Identity & Access Security
Authentication, Authorization, and Sessions: How Digital Access Works
Understand how identities prove who they are, receive permissions, and carry reusable authority through sessions.
Software Supply Chain Security
Build Provenance and Artifact Signing
Use provenance, signing, verification, and protected CI/CD identities to decide whether a software artifact can be trusted.
Cloud Security
Cloud Shared Responsibility and Operational Ownership
Translate cloud shared responsibility into testable ownership for identity, configuration, workloads, SaaS integrations, evidence, and recovery.
Vulnerability Intelligence
CVE Lifecycle and Vulnerability Records
Read CVE and NVD records as evolving evidence about a vulnerability, affected products, severity, exploitation, and remediation.
Detection Engineering
Detection Engineering Lifecycle
Design, test, deploy, tune, and maintain detections as evidence-producing security controls.
Network Security
DNS Investigations: Resolution Paths, Time, and Evidence
Use DNS questions, answers, resolution paths, timing, and multiple vantage points as bounded investigation evidence.
Incident Response
Evidence Preservation for Security Investigations
Preserve security evidence with enough context, integrity, and proportionality to support reliable investigation and action.
Security Awareness
Human Verification Under Pressure
Use independent verification and consequence-based decisions to resist urgent requests across email, chat, voice, video, and QR codes.
Identity & Access Security
Infostealers: Credential Theft, Session Theft, and Response
Understand how infostealers collect valuable access artifacts and how defenders contain, scope, and recover from exposure.
Network Security
OSI and TCP/IP Models in Practice
Use OSI and TCP/IP layers as practical reasoning tools for encapsulation, addressing, protocols, and troubleshooting.
Security Operations
Phishing Email Authentication and Safe Triage
Investigate suspicious email safely by separating message identity, authentication results, content, delivery path, and impact.
Identity & Access Security
Phishing-Resistant MFA and Secure Account Recovery
Compare authentication factors, recovery paths, and operational controls that resist phishing and help-desk abuse.
CTI Collection & Sources
Responsible OSINT Collection
Plan public-source research with clear authority, minimization, researcher safety, provenance, retention, and escalation boundaries.
Security Awareness
Safe Generative AI at Work
Make deliberate decisions about data, outputs, connectors, prompt injection, retention, and accountability when using generative AI.
Software Supply Chain Security
SBOMs in Practice
Use software bills of materials as maintained inventory evidence for component analysis, vulnerability triage, and supplier decisions.
Security Operations
Security Alert Triage: Evidence, Scope, Disposition, and Handoff
Turn an unfamiliar security alert into a bounded evidence claim, justified disposition, and useful responder handoff.
Detection Engineering
Security Telemetry Quality and Blind Spots
Evaluate whether security telemetry has the coverage, context, timing, and stability needed for investigation and detection.
Identity & Access Security
Session Hijacking: Cookies, Tokens, Detection, and Response
Learn how sessions are created, stolen, replayed, detected, revoked, and investigated across browsers and cloud services.
Incident Response
The Incident Response Lifecycle
Follow an evidence-led incident response lifecycle from preparation and triage through recovery and durable improvement.
CTI Collection & Sources
Traffic Distribution Systems in Cybercrime
Analyze traffic distribution systems as conditional routing layers without confusing dual-use technology, infrastructure, and criminal operations.
Identity & Access Security
Windows Authentication Evidence
Correlate Windows sign-in, Kerberos, NTLM, and local session evidence across identity and endpoint systems.
Security Operations
Windows Process-Tree Analysis
Interpret Windows process creation, command lines, lineage, files, and effects without treating a suspicious tree as proof.
CTI Collection & Sources
Cloud Threat Intelligence: How to Prioritize Identity, Control Plane, and Workload Signals
A practical method for turning cloud telemetry and threat reporting into prioritized intelligence about identities, control-plane activity, workloads, and business impact.
Microsoft Purview
Microsoft Purview Simulation First: Why Testing Policies Before Enforcement Matters
Simulation mode is one of the most important safety mechanisms in Microsoft Purview. Learn what it can reveal, what it cannot prove, the advantages and limitations, and how to turn simulatio...
Microsoft Purview
Microsoft Purview Data Map and Data Sources: Architecture, Scanning, Classification, and Best Practices
Understand how Microsoft Purview Data Map discovers and organizes enterprise metadata, how data sources are registered and scanned, and how to build a reliable governance foundation across c...
Microsoft Purview
Microsoft Purview Encryption Readiness: Risks, Pre-Enforcement Checks, Auto-Labeling, and Trainable Classifiers
Understand the technical, operational, collaboration, recovery, and classification checks that should be completed before sensitivity labels automatically encrypt Microsoft 365 content.
Microsoft Purview
Microsoft Purview Data Loss Prevention: Policy Design, Deployment, and Best Practices
Design Microsoft Purview DLP policies that protect sensitive information across Microsoft 365, endpoints, browsers, and collaboration workflows without creating unnecessary disruption for us...
Microsoft Purview
Microsoft Purview Sensitivity Labels: Design, Deployment, and Best Practices
Build a practical sensitivity-labeling model in Microsoft Purview that users can understand, automation can enforce, and security teams can use across Microsoft 365.
CTI Careers & Industry
How to Move From a SOC Role Into Cyber Threat Intelligence
Translate investigation experience into intelligence requirements, source evaluation, analytic judgments, writing, and decision-focused portfolio evidence.
CTI Careers & Industry
How to Evaluate a CTI Job Offer and the Team Behind It
Compare role reality, management, decision access, workload, development, ethics, compensation, and organizational support before accepting.
CTI Careers & Industry
Which Cyber Threat Intelligence Certification Should You Choose?
Select training or certification from the role you want, the skill gap you can demonstrate, delivery quality, total cost, and employer relevance.
CTI Careers & Industry
How to Build a CTI Portfolio Project That Demonstrates Real Skill
Create a lawful, reproducible project that begins with a decision, shows evidence and uncertainty, and ends with a useful intelligence product.
CTI Careers & Industry
Cyber Threat Intelligence Interview Guide: How to Prepare and Evaluate the Role
Prepare evidence-backed answers, analyze a realistic case, and ask questions that reveal whether the CTI role supports real decisions.
Strategic CTI
CTI for M&A Due Diligence: Questions to Ask Before and After the Deal
Use threat intelligence to test external exposure, targeting, critical dependencies, incident claims, and integration assumptions without replacing authorized diligence.
Strategic CTI
Geopolitical Cyber Risk: How to Decide What Matters to Your Organization
Connect political change to plausible cyber pathways, exposed business dependencies, warning indicators, and proportionate decisions.
Strategic CTI
What Should a Board-Level Cyber Threat Intelligence Report Include?
Give directors the judgments, business exposure, choices, evidence, and warning they need without turning the briefing into a technical activity report.
Strategic CTI
How to Build Cyber Threat Scenarios and Warning Indicators
Turn plausible threat futures into observable indicators, thresholds, owners, and advance decisions without pretending to predict one certain outcome.
Strategic CTI
How to Build a Threat Landscape Assessment for a Business Decision
Define scope, compare relevant threat changes, connect them to business exposure, and recommend choices instead of producing a catalog of actors.
CTI Sharing & Standards
How to Design a Threat Intelligence Sharing Agreement
Define purpose, participants, permitted use, handling, liability, privacy, security, correction, withdrawal, and exit before sensitive intelligence moves.
CTI Sharing & Standards
Should You Join an ISAC, ISAO, or Threat-Sharing Community?
Evaluate a sharing community through decision fit, peer relevance, trust, contribution expectations, speed, handling, workload, and demonstrated outcomes.
CTI Sharing & Standards
STIX vs TAXII: What Each Standard Does and When You Need It
Choose STIX to represent threat intelligence, TAXII to exchange it through an API, and both only when the use case justifies structured interoperability.
CTI Sharing & Standards
TLP 2.0 in Practice: Which Sharing Label Should You Use?
Choose TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, or TLP:RED from the source's intended sharing boundary.
Vulnerability Intelligence
Third-Party Vulnerability Exposure: How to Decide Which Supplier Risk Is Urgent
Move from a supplier vulnerability headline to an evidence-based decision using dependency, access, data, exploit activity, controls, and recovery options.
Vulnerability Intelligence
Patch, Mitigate, or Accept: How to Choose a Vulnerability Response
Compare remediation options through exposure, consequence, exploit evidence, control effectiveness, operational cost, reversibility, and residual risk.
Vulnerability Intelligence
Exploit Proof of Concept: How to Decide Whether It Changes Priority
Evaluate exploit claims, prerequisites, reliability, weaponization, affected versions, and local reachability without running untrusted code casually.
Vulnerability Intelligence
Zero-Day Response: How to Decide What to Do Before a Patch Exists
Assess relevance, exposure, exploitation evidence, consequence, and reversible controls when a newly disclosed vulnerability has no complete fix.
Vulnerability Intelligence
CVSS vs EPSS vs KEV: Which Signal Should Drive Vulnerability Priority?
Use CVSS for technical severity, EPSS for near-term exploitation probability, KEV for confirmed exploitation, and local context for the remediation decision.
CTI Technology & Platforms
AI-Assisted CTI: Safe Workflows for Research, Analysis, and Writing
Decide where AI can assist CTI, protect sensitive evidence, verify every consequential claim, and retain human ownership of analytic judgments.
CTI Technology & Platforms
How to Build a CTI Data Pipeline With Provenance and Quality Controls
Design ingestion, normalization, enrichment, curation, publication, expiry, and feedback around traceable evidence and defined intelligence uses.
CTI Technology & Platforms
Threat Intelligence Knowledge Graphs: When They Help and How to Design One
Decide whether relationship-heavy CTI questions justify a graph, then design entities, evidence-backed edges, time, identity, and analyst workflows.
CTI Technology & Platforms
CTI Integration Architecture: Connecting TIP, SIEM, SOAR, and EDR
Design intelligence flows around specific decisions, preserve context and expiry, and stop one unreliable artifact from causing action everywhere.
CTI Technology & Platforms
What to Automate in CTI—and What to Keep Human
Choose CTI automation by repeatability, evidence quality, reversibility, and consequence while preserving judgment, accountability, and review.
CTI Program Management
Managed CTI Services: When to Outsource and How to Choose
Decide which CTI work to retain, co-source, or outsource by testing accountability, access, context, quality, response, portability, and full cost.
CTI Program Management
How to Build a Business Case and Budget for Cyber Threat Intelligence
Tie CTI investment to priority decisions, service options, full operating cost, measurable assumptions, and staged commitments.
CTI Program Management
CTI Metrics That Show Whether Intelligence Changed a Decision
Measure service reliability, decision use, risk reduction signals, and learning without rewarding report volume or unexamined indicator counts.
CTI Program Management
How to Design a CTI Service Catalog People Can Actually Use
Define CTI services by consumer, decision, input, output, timing, owner, and boundary so people know what to request and what to expect.
CTI Program Management
Who Should You Hire First for a Cyber Threat Intelligence Team?
Choose the first CTI hires from priority services, existing capability, workload, and decision relationships instead of searching for one impossible all-rounder.
CTI Program Management
Centralized, Embedded, or Hybrid CTI: Which Team Model Fits?
Choose a CTI operating model from decision proximity, consistency, scale, and available expertise rather than copying another organization chart.
CTI Collection & Sources
Regional and Language Coverage in CTI: How to Find Your Blind Spots
Decide where language and regional collection matter, measure source imbalance, and build coverage that reflects your actual operations and suppliers.
CTI Collection & Sources
How to Verify a Cyber Threat Claim Before You Act or Share It
Trace online claims, screenshots, copied reports, and social posts to evidence, test context and independence, and choose a proportionate response.
CTI Collection & Sources
Dark Web Monitoring: When It Helps, What It Misses, and How to Decide
Decide whether dark web monitoring fits a real intelligence requirement, and define safe collection, validation, escalation, and service expectations.
CTI Collection & Sources
Passive DNS and WHOIS in CTI: What Can You Safely Conclude?
Use historical DNS and registration data for discovery and corroboration without mistaking co-location, privacy services, or stale records for shared control.
CTI Collection & Sources
How to Evaluate a Commercial Threat Intelligence Feed Before You Buy
Run a decision-based trial that tests unique coverage, relevance, timeliness, provenance, integration effort, and measurable operational value.
CTI Collection & Sources
How to Build an OSINT Collection Plan for Cyber Threat Intelligence
Convert an intelligence requirement into lawful, safe, source-specific OSINT tasks with validation rules, stop conditions, and a clear owner.
CTI Analysis & Tradecraft
Cognitive Bias in CTI: A Practical Review Checklist Before You Publish
Find confirmation bias, anchoring, mirror imaging, recency effects, and group pressure before they distort a consequential intelligence judgment.
CTI Analysis & Tradecraft
Malware Intelligence: Which Findings Should Change a Defensive Decision?
Turn malware analysis into CTI by selecting findings that improve scoping, detection, containment, prioritization, or warning.
CTI Analysis & Tradecraft
Threat Infrastructure Analysis: How Far Should You Pivot?
Investigate domains, IP addresses, certificates, hosting, and relationships while setting evidence thresholds that prevent false cluster expansion.
CTI Analysis & Tradecraft
Victimology in CTI: How to Decide Who Is Most Likely to Be Targeted
Analyze victim selection without confusing public visibility with adversary preference, then turn the pattern into a defensible warning decision.
CTI Analysis & Tradecraft
How to Build a Threat Actor Profile Without Overclaiming
Create a living actor profile that separates observed behavior, assessed capability, targeting, infrastructure, aliases, and uncertain attribution.
CTI Analysis & Tradecraft
How to Reconstruct a Cyber Campaign Timeline From Fragmented Evidence
Build an evidence-backed timeline across reports, infrastructure, malware, and incidents without turning uncertain dates into a false narrative.
CTI Analysis & Tradecraft
Diamond Model vs Cyber Kill Chain vs MITRE ATT&CK: Which Framework Fits?
Choose the analytic framework that matches your question: relationships with the Diamond Model, intrusion progress with the Kill Chain, or observable behavior with ATT&CK.
CTI Analysis & Tradecraft
How to Use Analysis of Competing Hypotheses in Cyber Threat Intelligence
Use ACH when several explanations fit the same evidence, compare them consistently, and show decision-makers what could change the leading judgment.
CTI Fundamentals
Likelihood, Confidence, and Risk in CTI: How to Read the Judgment Correctly
Understand what likelihood, analytic confidence, and business risk each mean so a threat assessment leads to a sound decision instead of a misleading score.
CTI Fundamentals
Is This Threat Relevant to Us? A Practical CTI Relevance Test
Decide whether a reported threat deserves attention by testing exposure, adversary intent, capability, opportunity, potential consequence, and the value of acting now.
CTI Fundamentals
How to Write an Intelligence Requirement That Produces a Useful Answer
Turn broad threat concerns into prioritized, answerable intelligence requirements with a named consumer, decision, scope, time horizon, collection questions, success criteria, and review tri...
CTI Fundamentals
Threat Intelligence vs Incident Response: Where One Ends and the Other Begins
Decide whether a security question belongs to Cyber Threat Intelligence, incident response, or a joint workflow—and design the handoffs that turn external context and incident evidence int...
CTI Fundamentals
Threat Intelligence vs Threat Hunting: Which Capability Solves Which Problem?
Decide whether a security problem needs threat intelligence, threat hunting, or both by comparing their questions, evidence, workflows, outputs, staffing, and measures of success.
CTI Fundamentals
Tactical, Operational, or Strategic CTI: Which Type Does Your Decision Need?
Choose the right level of Cyber Threat Intelligence by matching tactical, operational, and strategic products to the decision, audience, evidence, time horizon, and action required.
CTI Analysis & Tradecraft
How to Write a Cyber Threat Intelligence Report That Supports Decisions
Write CTI reports that readers can use by defining the decision, separating evidence from judgment, leading with key assessments, expressing likelihood and confidence, tailoring depth, expla...
Strategic CTI
Strategic Cyber Threat Intelligence: How to Brief Leaders and Support Business Decisions
Produce strategic Cyber Threat Intelligence that leaders can use by connecting external threats to business exposure, scenarios, likelihood, impact, warning indicators, options, and clear de...
CTI Sharing & Standards
Threat Intelligence Sharing: What to Share, With Whom, and How
Make defensible threat-intelligence sharing decisions by defining purpose and audience, minimizing sensitive data, applying TLP correctly, choosing human and machine-readable formats, preser...
Vulnerability Intelligence
Vulnerability Intelligence: How to Prioritize What to Fix First
Turn vulnerability data into remediation decisions by combining technical severity, exploitation evidence, exposure, asset importance, likely impact, controls, and operational constraints—...
CTI Technology & Platforms
Threat Intelligence Platforms: What They Do, When You Need One, and How to Choose
Decide whether your organization needs a threat intelligence platform, understand the capabilities a TIP should provide, compare build and buy options, evaluate vendors through real workflow...
CTI Program Management
How to Build a Cyber Threat Intelligence Program: Team, Process, Technology, and Metrics
Build a practical Cyber Threat Intelligence program from mission and requirements through services, staffing, sources, workflows, technology, governance, stakeholder integration, metrics, ma...
CTI Collection & Sources
Cyber Threat Intelligence Sources: Collection, Evaluation, and Corroboration
Learn how to build and evaluate a Cyber Threat Intelligence source portfolio, preserve provenance, distinguish source reliability from claim credibility, find original reporting, corroborate...
CTI Analysis & Tradecraft
Cyber Threat Attribution: Evidence, Confidence, and Common Pitfalls
Learn how cyber threat attribution is built and communicated: the levels of attribution, evidence types, clustering, hypothesis testing, confidence, naming problems, deception, legal and pol...
CTI Analysis & Tradecraft
Indicators of Compromise and TTPs: Turning Threat Evidence into Detection
Learn the difference between observables, indicators of compromise, and adversary tactics, techniques, and procedures—and how to preserve context, map behavior, engineer detections, manage...
CTI Fundamentals
The Cyber Threat Intelligence Lifecycle: From Requirements to Feedback
Learn how the Cyber Threat Intelligence lifecycle works in practice, from defining intelligence requirements and planning collection through processing, analysis, dissemination, feedback, an...
CTI Fundamentals
What Is Cyber Threat Intelligence? Definition, Process, Types, and Use Cases
Understand cyber threat intelligence from first principles: what it is, how it differs from threat data, the tactical, operational, and strategic layers, the intelligence lifecycle, core evi...
CTI Careers & Industry
Cyber Threat Intelligence Career Paths: From Analyst to CTI Leadership
Understand how a cyber threat intelligence career develops after the first role. Learn what changes from junior analyst to senior analyst, principal, team lead, manager, and head of CTI, how...
CTI Careers & Industry
How to Get Your First Cyber Threat Intelligence Job: A Practical Roadmap
Break into cyber threat intelligence with a practical, evidence-driven roadmap. Learn what entry-level CTI employers actually look for, how to build a portfolio without prior intelligence ex...
CTI Careers & Industry
Working in Cyber Threat Intelligence: Roles, Skills, and What It’s Really Like
Step inside the real world of cyber threat intelligence work. Explore the roles, daily workflows, essential skills, career pathways, and the unique mindset that separates top CTI analysts fr...