Find practical guides for building CTI capability, improving analysis, developing your career, and turning intelligence into action.
Choose a topic to see its complete collection.
Newest resources are shown first.
An evidence-led journey through Türkiye’s cyber power—from the “cyber homeland” strategy and 2025–2026 reorganization to military cyber operations, NATO integration, domestic indu...
An evidence-led journey through Indian cyber power—from the Defence Cyber Agency and 2025 joint doctrine to India-nexus espionage clusters, commercial operators, Operation Sindoor, critica...
An evidence-led journey through Chinese cyber power—from active defense and systems confrontation to the 2024 PLA reorganization, mass espionage, critical-infrastructure pre-positioning, t...
An evidence-led journey through American cyber power—from the reported Stuxnet operation and the campaign against ISIS to defend forward, global hunt operations, intelligence access, allia...
An evidence-led journey through Russia’s cyberwarfare system—from the Ukrainian power-grid attacks and NotPetya to SolarWinds, wartime wipers, logistics espionage, edge-device compromise...
Understand what the unified audit log records, how eDiscovery cases preserve and collect content, and how search, review, export, scope, and chain of reasoning affect an investigation.
Learn how Communication Compliance evaluates messages across supported channels, how classifiers and sampling shape review, and how privacy-aware workflows turn policy matches into proportio...
Learn how controls, assessments, improvement actions, testing, evidence, ownership, and compliance scoring fit together—and why a higher score is not the same as legal compliance.
Learn how retention policies, retention labels, records, event-based retention, holds, and disposition work together so information is kept for the right reason and deleted when that reason ...
Understand how Microsoft Purview Data Security Posture Management connects AI usage, sensitive-data exposure, recommendations, and existing Purview controls without treating a dashboard as p...
Learn how Exact Data Match sensitive information types use hashed reference data, primary fields, corroborative evidence, normalization, and testing to detect real records with fewer false p...
Understand how Insider Risk Management correlates user-related signals into reviewable alerts and cases while preserving the difference between risky activity, malicious intent, and an emplo...
Build confidence in OT detections through progressively stronger, process-approved evidence while keeping validation and response from creating the physical harm they are meant to prevent.
Relate engineers, vendor access, jump hosts, workstations, privileged sessions, controller actions, and work authorization so OT remote access can be interpreted without treating identity su...
Interpret passive OT network evidence through protocol operations, asset roles, direction, operating mode, and sensor position without confusing an observed request with a completed physical...
Write OT detection requirements from physical consequence, process state, engineering authority, and safe decision latency rather than importing assumptions from office IT.
Measure whether deception answers an intelligence question and improves a decision, rather than rewarding trigger volume, deployed-decoy counts, or dramatic stories.
Set technical, legal, privacy, and operational boundaries for defensive deception before deployment so observation never becomes uncontrolled access, collection, or engagement.
Preserve deception evidence from decoy creation through placement, trigger, collection, transformation, and investigation so a strong signal remains reproducible and defensible.
Design honeytokens and decoy resources as controlled security claims whose placement, capability, trigger, and legitimate exposure determine what an interaction can actually prove.
Detect cloud-side data movement through sharing, snapshots, replication, exports, and cross-account copies by following ownership and authority changes that network-only monitoring can miss.
Reason about exfiltration across network, SaaS, cloud, email, removable media, and covert channels by separating transfer-shaped evidence from proof of content and intent.
Recognize staging, archiving, transformation, and bulk collection as preparation for possible data movement while preserving legitimate backup, analytics, migration, and response explanation...
Interpret access to sensitive objects through subject, object, operation, purpose, peer context, and history without turning statistical deviation into a claim of malicious intent.
Detect fraud around payment, payroll, procurement, legal, and recovery workflows by protecting consequential state transitions and the authority and verification behind them.
Reason about external sharing, guest access, links, invitations, and delegated collaboration authority through resource sensitivity, audience, lifetime, and observed use.
Detect mailbox rules, forwarding, delegation, and permission changes by separating configuration, authority, message effect, and legitimate workflow context.
Read message trace, authentication results, routing, delivery, and mailbox events as separate evidence so email detections do not confuse sender claims with verified origin or delivery with ...
Design privacy-safe logging for prompts, retrieval, memory, model outputs, and tool actions by selecting the least sensitive evidence that can support a defined security decision.
Detect when an agent's exercised authority, tool sequence, target scope, or consequence exceeds the bounded purpose and confirmation policy of the initiating task.
Specify telemetry for AI tool calls and Model Context Protocol interactions that preserves caller, authority, operation, target, protected arguments, policy, result, and trace relationships.
Represent the initiating user, application, agent instance, model operation, delegated credential, tool, and target resource as distinct identities so agent actions remain attributable and b...
Use metadata from encrypted traffic to assess communication behavior while keeping payload content, application identity, user intent, and attribution outside claims the evidence cannot supp...
Use artifact provenance and attestations as signed statements about build relationships, then detect mismatches without treating presence, signature validity, or high assurance as proof that...
Detect abuse in source, build, package, secret, and deployment systems by following identities and artifacts across trust boundaries rather than treating pipeline success as legitimacy.
Interpret Kubernetes audit events as API-server observations whose stage, level, identity, resource, authorization, and policy limits determine what a detection can honestly claim.
Reason from SaaS audit records without assuming that a vendor’s event catalog, retention tier, actor field, or successful response provides complete security visibility.
Design cloud detections around control-plane requests, identities, resources, policy decisions, and asynchronous effects while respecting provider-specific logging boundaries.
Detect identity abuse by separating grants, tokens, sessions, clients, and resource access, then reasoning about issuance, binding, rotation, revocation, and replay evidence.
Apply purpose limitation, necessity, minimization, access control, retention, and oversight to security monitoring while preserving the evidence needed for a defined defensive decision.
Define detection service levels around consumer outcomes, measure them with trustworthy indicators, and use error budgets to govern reliability tradeoffs without hiding security gaps.
Accumulate related evidence into transparent, time-bounded risk without letting a convenient score erase provenance, uncertainty, or the distinction between suspicion and fact.
Use detection metrics to answer operational and security questions with defined populations, denominators, time windows, and uncertainty instead of celebrating activity counts.
Govern exceptions, suppressions, and allowlists as expiring changes to detection scope, with evidence, ownership, review, and visible residual risk.
Define the evidence, reasoning, context, ownership, and service behavior an alert must provide before asking an investigator to make a decision.
Retire detections when their claim, evidence, platform, or consumer need has ended, while preserving lineage and proving that no silent coverage gap remains.
Introduce detection changes to a bounded population, compare them with a known baseline, and preserve a rollback path that restores service rather than merely restoring a file.
Detect when a detection service stops observing, interpreting, or delivering expected evidence—even though no explicit platform error appears.
Choose replay, synthetic telemetry, simulation, or emulation by the assumptions you need to test, recognizing what each method introduces, bypasses, and can safely prove.
Use positive, negative, boundary, and regression tests to define what a detection should recognize, reject, do at exact edges, and continue doing after change.
Build confidence through many fast semantic tests, fewer integration tests, and carefully governed end-to-end scenarios, with each layer proving only the assumptions it actually exercises.
Model shared telemetry, mappings, components, filters, converters, schemas, deployment targets, and delivery routes as a versioned dependency graph that can be tested and packaged with detec...
Give detection content stable identity, ownership, evidence requirements, dependencies, tests, deployment state, consumer context, and lifecycle information so a rule can be operated rather ...
Treat portable detection content as a statement of intent whose meaning can change through field mappings, backend capabilities, query semantics, and execution policy.
Use Sigma filters as explicit, governed overlays that separate shared detection intent from environment-specific exclusions without hiding changed scope.
Understand Sigma 2.1 correlation as stateful reasoning over related events, with explicit aliases, grouping, windows, order, cardinality, and backend limits.
Design telemetry around explicit evidence value, query and retention needs, shared dependencies, and degradation choices so cost control does not silently erase detection capability.
Track telemetry from producer through collection, transformation, enrichment, storage, and analytics, using integrity evidence to verify origin and change without confusing authenticity with...
Use OCSF 1.9 as a shared security-event language while keeping observation, profile conformance, extensions, mappings, and local validation separate from coverage claims.
Create a common analytical view without erasing provider meaning, source values, transformation history, or the distinctions needed to verify a detection result.
Relate users, sessions, devices, workloads, applications, and resources across changing identifiers without turning uncertain joins into false identity or causality.
Distinguish event, observation, ingest, and processing time so windows and sequences reflect behavior without hiding clock drift, delayed delivery, or late evidence.
A telemetry data contract makes event meaning, fields, timing, populations, ownership, change, and failure visible so detections do not depend on undocumented assumptions.
Use Attack Flow to represent ordered, branching adversary behavior and place detection opportunities where evidence can distinguish progress, alternatives, and defensive interruption.
An ATT&CK mapping shows relevance to adversary behavior; detection coverage requires local evidence, tested scope, healthy dependencies, a consumer, and explicit uncertainty.
Use ATT&CK v19's Stealth and Defense Impairment tactics to reason about visibility degradation, while keeping tactic labels separate from proof of malicious intent or local coverage.
Understand ATT&CK Data Components as descriptions of security-relevant information, and migrate older Data Source mappings without mistaking taxonomy changes for deployed visibility.
Prioritize detection work by threat relevance, consequence, evidential feasibility, decision value, maintenance cost, and current uncertainty instead of chasing rule counts or matrix color.
Choose a match, threshold, sequence, graph, baseline, or risk model by the security claim you need to support—not by which feature a platform makes easiest to deploy.
Learn to distinguish necessary behavior from details an adversary can cheaply change, without pretending that any invariant is universal or permanently observable.
Move from a broad threat model to a falsifiable prediction about the evidence a particular behavior path should leave—and the ordinary explanations that could resemble it.
A detection requirement is the reasoning that connects a threat concern to a consumer, observable evidence, a testable claim, and an honest boundary of coverage.
Read MITRE ATT&CK v19 detection strategies, analytics, and data components as a layered knowledge model without mistaking framework mappings for deployed coverage.
Keep signal, analytic, alert, incident, and response distinct so evidence can move through the detection service without conclusions becoming stronger by accident.
Follow the construction of Iran’s controlled internet from the Green Movement to the 2026 war, then examine how blackouts, whitelisting, surveillance, airstrikes, routing instability, and ...
Map Iran’s cyber operating ecosystem without collapsing government units, contractors, front companies, criminal partners, hacktivists, and online personas into a single unsupported attrib...
Build bounded cyber attribution judgments by separating activity clusters, operators, organizations, state relationships, public responsibility, and legal attribution.
Examine how compromised cameras, telecommunications data, geolocation, and digital surveillance can support target development and battle-damage assessment in the 2026 Iran war—without con...
A deep examination of the Iranian drone strikes that damaged AWS facilities in the UAE and Bahrain, their cloud-service effects, military significance, civilian exposure, legal questions, an...
Build defensible cyber campaign concepts by connecting policy aims to behavior, operational functions, effects, authorities, intelligence, risk, assessment, and termination.
Trace cyber effects through shared systems and essential services, identify civilian consequences, and build precautions, monitoring, and stop conditions into operational design.
Govern authorized cyber access as a scarce mission asset through purpose, authority, intelligence gain-loss, OPSEC, safety, deconfliction, and termination decisions.
Design cyber deterrence as a behavior-specific portfolio of denial, resilience, exposure, law enforcement, diplomacy, costs, partnerships, and communication.
Measure whether cyber activity changed systems, missions, behavior, and strategy using causal chains, baselines, counterfactuals, indicators, and independent challenge.
Identify the identities, data, services, control points, providers, and recovery paths whose control creates decisive mission advantage.
Understand how states establish durable access before a crisis, distinguish pre-positioning from espionage, and turn weak signals into proportionate defensive action.
Build decision-led intelligence requirements, indicators, collection plans, thresholds, and warning judgments for cyber crisis and conflict.
Analyze the full influence chain from intrusion and content selection through laundering, amplification, audience effects, attribution, and trust-preserving response.
An evidence-led history and current assessment of the Iran–United States cyber conflict, including espionage, industrial disruption, critical-infrastructure operations, cloud strikes, cybe...
Distinguish cyberwarfare from cybercrime, espionage, influence, preparation, and ordinary military support by examining purpose, authority, context, target, and effect.
Take calm, prioritized action after suspicious access, malware, device loss, or data exposure while preserving trustworthy recovery options.
Reduce unnecessary data exposure, share deliberately, manage permissions and retention, and maintain backups that can actually restore what matters.
Use modern connection security, trustworthy destinations, careful downloads, and bounded app permissions without relying on security myths.
Protect phones, laptops, tablets, and smart devices through supported software, trusted apps, secure configuration, encryption, and loss preparation.
Use assets, threats, vulnerabilities, likelihood, impact, and defense in depth to make practical everyday security decisions.
Test telemetry, logic, enrichment, alert delivery, and analyst outcomes with safe, repeatable malicious and benign scenarios.
Control credentials across source, build, deployment, and runtime with scoped identities, short lifetimes, safe injection, monitoring, and rehearsed rotation.
Coordinate isolation, evidence, identity containment, business continuity, restoration, and extortion decisions during a ransomware incident.
Recognize impersonation and mailbox compromise, verify sensitive requests independently, and coordinate fast action after a fraudulent payment.
Use unique credentials safely, protect password vaults, recognize credential stuffing, and respond proportionately when passwords may be exposed.
Understand delegated access, consent grants, scopes, tokens, connected-app risk, and the evidence needed to investigate or revoke access safely.
Understand how identities prove who they are, receive permissions, and carry reusable authority through sessions.
Use provenance, signing, verification, and protected CI/CD identities to decide whether a software artifact can be trusted.
Translate cloud shared responsibility into testable ownership for identity, configuration, workloads, SaaS integrations, evidence, and recovery.
Read CVE and NVD records as evolving evidence about a vulnerability, affected products, severity, exploitation, and remediation.
Design, test, deploy, tune, and maintain detections as evidence-producing security controls.
Use DNS questions, answers, resolution paths, timing, and multiple vantage points as bounded investigation evidence.
Preserve security evidence with enough context, integrity, and proportionality to support reliable investigation and action.
Use independent verification and consequence-based decisions to resist urgent requests across email, chat, voice, video, and QR codes.
Understand how infostealers collect valuable access artifacts and how defenders contain, scope, and recover from exposure.
Use OSI and TCP/IP layers as practical reasoning tools for encapsulation, addressing, protocols, and troubleshooting.
Investigate suspicious email safely by separating message identity, authentication results, content, delivery path, and impact.
Compare authentication factors, recovery paths, and operational controls that resist phishing and help-desk abuse.
Plan public-source research with clear authority, minimization, researcher safety, provenance, retention, and escalation boundaries.
Make deliberate decisions about data, outputs, connectors, prompt injection, retention, and accountability when using generative AI.
Use software bills of materials as maintained inventory evidence for component analysis, vulnerability triage, and supplier decisions.
Turn an unfamiliar security alert into a bounded evidence claim, justified disposition, and useful responder handoff.
Evaluate whether security telemetry has the coverage, context, timing, and stability needed for investigation and detection.
Learn how sessions are created, stolen, replayed, detected, revoked, and investigated across browsers and cloud services.
Follow an evidence-led incident response lifecycle from preparation and triage through recovery and durable improvement.
Analyze traffic distribution systems as conditional routing layers without confusing dual-use technology, infrastructure, and criminal operations.
Correlate Windows sign-in, Kerberos, NTLM, and local session evidence across identity and endpoint systems.
Interpret Windows process creation, command lines, lineage, files, and effects without treating a suspicious tree as proof.
A practical method for turning cloud telemetry and threat reporting into prioritized intelligence about identities, control-plane activity, workloads, and business impact.
Simulation mode is one of the most important safety mechanisms in Microsoft Purview. Learn what it can reveal, what it cannot prove, the advantages and limitations, and how to turn simulatio...
Understand how Microsoft Purview Data Map discovers and organizes enterprise metadata, how data sources are registered and scanned, and how to build a reliable governance foundation across c...
Understand the technical, operational, collaboration, recovery, and classification checks that should be completed before sensitivity labels automatically encrypt Microsoft 365 content.
Design Microsoft Purview DLP policies that protect sensitive information across Microsoft 365, endpoints, browsers, and collaboration workflows without creating unnecessary disruption for us...
Build a practical sensitivity-labeling model in Microsoft Purview that users can understand, automation can enforce, and security teams can use across Microsoft 365.
Translate investigation experience into intelligence requirements, source evaluation, analytic judgments, writing, and decision-focused portfolio evidence.
Compare role reality, management, decision access, workload, development, ethics, compensation, and organizational support before accepting.
Select training or certification from the role you want, the skill gap you can demonstrate, delivery quality, total cost, and employer relevance.
Create a lawful, reproducible project that begins with a decision, shows evidence and uncertainty, and ends with a useful intelligence product.
Prepare evidence-backed answers, analyze a realistic case, and ask questions that reveal whether the CTI role supports real decisions.
Use threat intelligence to test external exposure, targeting, critical dependencies, incident claims, and integration assumptions without replacing authorized diligence.
Connect political change to plausible cyber pathways, exposed business dependencies, warning indicators, and proportionate decisions.
Give directors the judgments, business exposure, choices, evidence, and warning they need without turning the briefing into a technical activity report.
Turn plausible threat futures into observable indicators, thresholds, owners, and advance decisions without pretending to predict one certain outcome.
Define scope, compare relevant threat changes, connect them to business exposure, and recommend choices instead of producing a catalog of actors.
Define purpose, participants, permitted use, handling, liability, privacy, security, correction, withdrawal, and exit before sensitive intelligence moves.
Evaluate a sharing community through decision fit, peer relevance, trust, contribution expectations, speed, handling, workload, and demonstrated outcomes.
Choose STIX to represent threat intelligence, TAXII to exchange it through an API, and both only when the use case justifies structured interoperability.
Choose TLP:CLEAR, TLP:GREEN, TLP:AMBER, TLP:AMBER+STRICT, or TLP:RED from the source's intended sharing boundary.
Move from a supplier vulnerability headline to an evidence-based decision using dependency, access, data, exploit activity, controls, and recovery options.
Compare remediation options through exposure, consequence, exploit evidence, control effectiveness, operational cost, reversibility, and residual risk.
Evaluate exploit claims, prerequisites, reliability, weaponization, affected versions, and local reachability without running untrusted code casually.
Assess relevance, exposure, exploitation evidence, consequence, and reversible controls when a newly disclosed vulnerability has no complete fix.
Use CVSS for technical severity, EPSS for near-term exploitation probability, KEV for confirmed exploitation, and local context for the remediation decision.
Decide where AI can assist CTI, protect sensitive evidence, verify every consequential claim, and retain human ownership of analytic judgments.
Design ingestion, normalization, enrichment, curation, publication, expiry, and feedback around traceable evidence and defined intelligence uses.
Decide whether relationship-heavy CTI questions justify a graph, then design entities, evidence-backed edges, time, identity, and analyst workflows.
Design intelligence flows around specific decisions, preserve context and expiry, and stop one unreliable artifact from causing action everywhere.
Choose CTI automation by repeatability, evidence quality, reversibility, and consequence while preserving judgment, accountability, and review.
Decide which CTI work to retain, co-source, or outsource by testing accountability, access, context, quality, response, portability, and full cost.
Tie CTI investment to priority decisions, service options, full operating cost, measurable assumptions, and staged commitments.
Measure service reliability, decision use, risk reduction signals, and learning without rewarding report volume or unexamined indicator counts.
Define CTI services by consumer, decision, input, output, timing, owner, and boundary so people know what to request and what to expect.
Choose the first CTI hires from priority services, existing capability, workload, and decision relationships instead of searching for one impossible all-rounder.
Choose a CTI operating model from decision proximity, consistency, scale, and available expertise rather than copying another organization chart.
Decide where language and regional collection matter, measure source imbalance, and build coverage that reflects your actual operations and suppliers.
Trace online claims, screenshots, copied reports, and social posts to evidence, test context and independence, and choose a proportionate response.
Decide whether dark web monitoring fits a real intelligence requirement, and define safe collection, validation, escalation, and service expectations.
Use historical DNS and registration data for discovery and corroboration without mistaking co-location, privacy services, or stale records for shared control.
Run a decision-based trial that tests unique coverage, relevance, timeliness, provenance, integration effort, and measurable operational value.
Convert an intelligence requirement into lawful, safe, source-specific OSINT tasks with validation rules, stop conditions, and a clear owner.
Find confirmation bias, anchoring, mirror imaging, recency effects, and group pressure before they distort a consequential intelligence judgment.
Turn malware analysis into CTI by selecting findings that improve scoping, detection, containment, prioritization, or warning.
Investigate domains, IP addresses, certificates, hosting, and relationships while setting evidence thresholds that prevent false cluster expansion.
Analyze victim selection without confusing public visibility with adversary preference, then turn the pattern into a defensible warning decision.
Create a living actor profile that separates observed behavior, assessed capability, targeting, infrastructure, aliases, and uncertain attribution.
Build an evidence-backed timeline across reports, infrastructure, malware, and incidents without turning uncertain dates into a false narrative.
Choose the analytic framework that matches your question: relationships with the Diamond Model, intrusion progress with the Kill Chain, or observable behavior with ATT&CK.
Use ACH when several explanations fit the same evidence, compare them consistently, and show decision-makers what could change the leading judgment.
Understand what likelihood, analytic confidence, and business risk each mean so a threat assessment leads to a sound decision instead of a misleading score.
Decide whether a reported threat deserves attention by testing exposure, adversary intent, capability, opportunity, potential consequence, and the value of acting now.
Turn broad threat concerns into prioritized, answerable intelligence requirements with a named consumer, decision, scope, time horizon, collection questions, success criteria, and review tri...
Decide whether a security question belongs to Cyber Threat Intelligence, incident response, or a joint workflow—and design the handoffs that turn external context and incident evidence int...
Decide whether a security problem needs threat intelligence, threat hunting, or both by comparing their questions, evidence, workflows, outputs, staffing, and measures of success.
Choose the right level of Cyber Threat Intelligence by matching tactical, operational, and strategic products to the decision, audience, evidence, time horizon, and action required.
Write CTI reports that readers can use by defining the decision, separating evidence from judgment, leading with key assessments, expressing likelihood and confidence, tailoring depth, expla...
Produce strategic Cyber Threat Intelligence that leaders can use by connecting external threats to business exposure, scenarios, likelihood, impact, warning indicators, options, and clear de...
Make defensible threat-intelligence sharing decisions by defining purpose and audience, minimizing sensitive data, applying TLP correctly, choosing human and machine-readable formats, preser...
Turn vulnerability data into remediation decisions by combining technical severity, exploitation evidence, exposure, asset importance, likely impact, controls, and operational constraints—...
Decide whether your organization needs a threat intelligence platform, understand the capabilities a TIP should provide, compare build and buy options, evaluate vendors through real workflow...
Build a practical Cyber Threat Intelligence program from mission and requirements through services, staffing, sources, workflows, technology, governance, stakeholder integration, metrics, ma...
Learn how to build and evaluate a Cyber Threat Intelligence source portfolio, preserve provenance, distinguish source reliability from claim credibility, find original reporting, corroborate...
Learn how cyber threat attribution is built and communicated: the levels of attribution, evidence types, clustering, hypothesis testing, confidence, naming problems, deception, legal and pol...
Learn the difference between observables, indicators of compromise, and adversary tactics, techniques, and procedures—and how to preserve context, map behavior, engineer detections, manage...
Learn how the Cyber Threat Intelligence lifecycle works in practice, from defining intelligence requirements and planning collection through processing, analysis, dissemination, feedback, an...
Understand cyber threat intelligence from first principles: what it is, how it differs from threat data, the tactical, operational, and strategic layers, the intelligence lifecycle, core evi...
Understand how a cyber threat intelligence career develops after the first role. Learn what changes from junior analyst to senior analyst, principal, team lead, manager, and head of CTI, how...
Break into cyber threat intelligence with a practical, evidence-driven roadmap. Learn what entry-level CTI employers actually look for, how to build a portfolio without prior intelligence ex...
Step inside the real world of cyber threat intelligence work. Explore the roles, daily workflows, essential skills, career pathways, and the unique mindset that separates top CTI analysts fr...
