Security Intelligence Operations Course

Lesson 1 • The Intelligence Cycle

Examines each phase of the intelligence cycle from planning through dissemination. Provides the operational framework used throughout the course.

Lesson 2 • Defining Security Intelligence

Covers the scope, purpose, and boundaries of security intelligence as a professional field. Anchors all subsequent technical content in a shared vocabulary.

Lesson 3 • Threat Landscape Overview

Surveys the categories of adversaries, motivations, and attack vectors relevant to security operations. Contextualizes why intelligence is essential to defense.

Lesson 4 • Intelligence Requirements and Tasking

Teaches how to translate organizational risk into actionable intelligence requirements. Links stakeholder needs to collection priorities.

Lesson 1 • Technical Intelligence Sources

Examines network-based, log-derived, and sensor-generated data as intelligence inputs. Connects technical telemetry to actionable intelligence products.

Lesson 2 • Collection Planning and Deconfliction

Synthesizes multi-source collection into a coherent plan that avoids duplication and gaps. Reinforces the intelligence cycle's collection phase.

Lesson 3 • Human Intelligence in Security Contexts

Addresses the role of human sources, interviews, and liaison relationships in security intelligence. Emphasizes ethical handling and source protection.

Lesson 4 • Commercial and Third-Party Feeds

Evaluates commercial threat intelligence feeds and information-sharing communities. Teaches criteria for vendor selection and feed integration.

Lesson 1 • Data Quality and Provenance

Establishes standards for assessing and documenting data quality throughout the processing pipeline. Ensures analytical conclusions rest on reliable inputs.

Lesson 2 • Data Normalization and Structuring

Teaches methods for converting heterogeneous data formats into consistent, queryable structures. Directly enables accurate analysis in later chapters.

Lesson 3 • Automation in Data Processing

Introduces scripting and workflow automation to handle high-volume data processing tasks. Reduces analyst burden and accelerates the processing phase.

Lesson 4 • Indicator Management and Lifecycle

Covers the creation, validation, aging, and retirement of threat indicators. Prevents indicator decay from degrading operational detection quality.

Lesson 1 • Structured Analytic Techniques

Introduces formal methods that impose rigor and reduce cognitive bias in analysis. Forms the methodological backbone of all analytical work in the course.

Lesson 2 • Kill Chain and Attack Lifecycle Analysis

Applies attack lifecycle models to map adversary behavior and identify intervention points. Bridges threat data to defensive action.

Lesson 3 • MITRE ATT&CK Framework Application

Operationalizes the ATT&CK knowledge base for threat profiling, gap analysis, and detection engineering. Connects adversary behavior to defensive controls.

Lesson 4 • Analytical Writing and Confidence Levels

Develops precise analytical writing skills including the use of standardized confidence and probability language. Ensures intelligence products communicate uncertainty accurately.

Lesson 1 • Dissemination Channels and Controls

Addresses secure and appropriate distribution of intelligence products across organizational tiers. Prevents unauthorized disclosure while maximizing utility.

Lesson 2 • Visualization and Data Presentation

Covers graphical techniques for communicating complex intelligence findings clearly. Enhances comprehension and retention among non-technical consumers.

Lesson 3 • Measuring Intelligence Effectiveness

Establishes metrics and feedback mechanisms to evaluate whether intelligence products influenced decisions. Closes the intelligence cycle with actionable improvement data.

Lesson 4 • Intelligence Product Types

Surveys the full range of intelligence products from tactical alerts to strategic assessments. Aligns product selection with consumer role and decision timeline.

Lesson 1 • Hypothesis Development

Teaches how to generate testable hunting hypotheses from threat intelligence and ATT&CK mappings. Directly applies analytical skills from Chapter 4.

Lesson 2 • Hunt Documentation and Reporting

Establishes standards for recording hunt methodology, findings, and detection opportunities. Converts hunt outputs into durable organizational knowledge.

Lesson 3 • Hunt Execution and Data Analysis

Covers query construction, data pivoting, and anomaly identification during active hunts. Builds hands-on proficiency with hunting tools and datasets.

Lesson 4 • Operationalizing Hunt Findings

Translates hunt results into detection rules, intelligence requirements, and process improvements. Demonstrates the strategic value of proactive operations.

Lesson 1 • Malware and Artifact Analysis

Covers static and behavioral analysis of malicious artifacts to extract intelligence value. Connects technical findings to adversary profiling from Chapter 4.

Lesson 2 • Containment and Eradication Intelligence

Applies intelligence to inform containment scope and eradication completeness decisions. Reduces re-infection risk through adversary-aware response actions.

Lesson 3 • Intelligence Support to Incident Response

Defines the intelligence analyst's role within an incident response team and workflow. Establishes how intelligence accelerates triage and scoping decisions.

Lesson 4 • Campaign Tracking and Correlation

Teaches methods for linking discrete incidents into broader adversary campaigns. Enables strategic response and long-term adversary tracking.

Lesson 1 • Metrics, Maturity, and Governance

Establishes frameworks for measuring program maturity and demonstrating value to leadership. Enables data-driven program improvement and executive reporting.

Lesson 2 • Intelligence Program Design

Covers the structural components of a scalable intelligence program including team roles and workflows. Provides a blueprint for building or maturing an organizational capability.

Lesson 3 • Intelligence Sharing and Partnerships

Addresses formal and informal intelligence-sharing arrangements with peers, government, and industry. Expands collection reach and analytical depth through collaboration.

Lesson 4 • Strategic Threat Assessment

Teaches long-horizon analysis of threat trends, geopolitical factors, and technology shifts. Equips analysts to advise executive leadership on future risk.