Threat Intelligence Fundamentals

What this cybersecurity course is

Threat Intelligence Fundamentals is a 6-module cybersecurity course for SOC analysts, incident responders, and security engineers moving into cyber threat intelligence (CTI) roles. Every module is grounded in primary-source frameworks: the Diamond Model of Intrusion Analysis (Caltagirone, Pendergast & Betz 2013), the Lockheed Martin Cyber Kill Chain (Hutchins, Cloppert & Amin 2011), MITRE ATT&CK Enterprise v15, STIX 2.1 and TAXII 2.1 (OASIS standards), Heuer's Psychology of Intelligence Analysis (CIA 1999), and Heuer & Pherson's Structured Analytic Techniques (2014). The course covers strategic, operational, and tactical CTI; how to write a finished intelligence product an executive will read; how to use STIX bundles to share indicators across organizations; and how the Traffic Light Protocol (TLP) governs information sharing. Designed by Julian Calvo, Ed.D. in Applied Learning Sciences (University of Miami, 2026).

The course sequences six modules around the intelligence lifecycle as defined in tradecraft literature: requirements, collection, processing, analysis, dissemination, feedback. Each module pairs a primary-source standard with a hands-on artifact: read the standard, write the analytic product the way the intelligence tradition expects to see it, evaluate the product against an analyst-checklist drawn from Heuer (1999) and CIA's analytic standards. The pedagogical pattern follows Kolb's experiential learning cycle (1984): concrete intelligence task, structured reflection against a tradecraft standard, abstract conceptualization through the framework, then active experimentation with a real CTI source. Every claim cites a primary-source framework, a peer-reviewed paper, MITRE/CISA, or BLS/ISC2. No vendor CTI-platform marketing.

Six modules

1. Module 01 · 120 minThe Intelligence Lifecycle and Why CTI Inherits It+

   The six-step intelligence lifecycle from US national-intelligence tradecraft, why CTI uses the same structure, and what each step looks like at a corporate cyber-threat-intelligence team.

   Learning objectives

   • Cite the six steps of the intelligence lifecycle (requirements, collection, processing, analysis, dissemination, feedback) and identify the deliverable each step produces in a CTI context
   • Distinguish strategic, operational, and tactical CTI by audience, time horizon, and the form of the finished product
   • Apply the Traffic Light Protocol (TLP 2.0) to a sample CTI product and explain who can receive each TLP level
2. Module 02 · 130 minThe Diamond Model and the Cyber Kill Chain+
3. Module 03 · 130 minStructured Analytic Techniques in CTI+
4. Module 04 · 110 minSTIX, TAXII, and Cross-Organization Information Sharing+
5. Module 05 · 110 minWriting Finished Intelligence Products+
6. Module 06 · 100 minThe CTI Career Trajectory+

Target audience

• SOC analysts moving into Tier 3 hunting or threat intelligence roles
• Incident responders who want to ground their post-incident analysis in tradecraft frameworks
• Security engineers responsible for detection content who want to consume CTI sources critically
• Cybersecurity practitioners preparing for the GIAC GCTI examination
• Cyber-curious adults from journalism, OSINT research, or policy backgrounds entering defensive CTI

Prerequisites

• Working SOC or detection-engineering experience or completion of DecipherU's SOC Analyst Fundamentals course
• Basic familiarity with MITRE ATT&CK (the Threat Landscape module of SOC Analyst Fundamentals covers what is required)
• Comfort reading APT-group reports and writing analytic prose
• Willingness to commit 8 to 10 weeks of 4 to 6 hours per week study

Related cybersecurity content

• Threat Intelligence Analyst cybersecurity career guide
• Threat Intelligence Analyst salary data
• Threat Hunter cybersecurity career guide
• SOC Analyst Fundamentals (the cybersecurity prerequisite path)

Disclaimer

This course is for educational purposes only. CTI work involves judgments about adversaries that carry real-world consequences for the targets and the analysts. The tradecraft taught here applies to defensive CTI; readers must consult counsel and ethics review for any work that approaches active engagement with adversary infrastructure. Government-classified CTI tradecraft is not covered. NIST, MITRE, CISA, and CIA materials cited here are public works. STIX and TAXII are OASIS open standards. DecipherU is not affiliated with any CTI vendor or government intelligence service.