Strategic Threat Intelligence for Analysts & SOC Operations

Introduction to the section, key topics to be covered, and call to action.

Defines intelligence as a decision-enabling product, not a dataset or dashboard. Drawing from military and cyber intelligence tradecraft, learners explore how intelligence differs from information, indicators, and analysis outputs. The focus is on purpose, context, and actionability why intelligence exists and who it serves.

Learners are introduced to strategic, operational, and tactical intelligence, with emphasis on how each supports different stakeholders and timelines. The video explains why misalignment such as using tactical indicators for strategic decisions creates false confidence and missed risk.

Walks through the intelligence cycle requirements, collection, processing, analysis, dissemination, and feedback showing how it applies to cyber threat intelligence programs. Learners see how skipping steps or treating the cycle as linear undermines analytic integrity.

Learners explore how poorly defined intelligence questions lead to irrelevant analysis and wasted collection. The video introduces techniques for turning vague concerns (“Are we being targeted?”) into answerable intelligence requirements.

This video introduces structured problem analysis techniques to decompose intelligence questions into observable elements. Learners practice identifying assumptions, constraints, and indicators that make intelligence questions tractable.The emphasis is on analytic discipline, not mathematical modeling.

Learners are shown how to use MITRE ATT&CK as a problem-structuring tool, not a threat feed. The demo illustrates how ATT&CK helps scope adversary behavior, validate assumptions, and identify analytic gaps without conflating coverage with intelligence.

Explore common intelligence models used to represent adversaries, capabilities, intent, and constraints. The video explains why models are simplifications, how they guide collection and analysis, and how misuse creates blind spots.

This demo shows how analysts model target environments networks, processes, and dependencies to understand where adversaries can act. Learners see how system context transforms generic TTPs into meaningful risk insights. Highlights Boyd’s Center of Gravity analysis with a Mural demonstration

This video addresses one of the hardest intelligence challenges: the customer relationship. Learners explore expectation management, confidence communication, and how to handle ambiguity without overstating certainty.

Introduction to the section, key topics to be covered, and call to action.

Introduces structured research strategies for open-source intelligence, emphasizing intentional collection over opportunistic searching. Learners explore how to scope sources, validate credibility, and avoid collection bias while maintaining analytic relevance.

This video examines the dark web as an intelligence environment, not a novelty. Learners explore access considerations, operational risks, and the limitations of dark-web data, with emphasis on signal versus deception and the ethical boundaries of collection.

This video focuses on filtering techniques that reduce noise and prevent analytic overload. Learners examine how tagging, prioritization, and relevance criteria transform raw OSINT into inputs suitable for structured analysis, without prematurely drawing conclusions.

This video introduces common malware intelligence sources and explains how malware artifacts contribute to understanding adversary capability and intent. Learners assess the tradeoffs between accessibility, fidelity, and legal considerations when working with malware-derived data.

This demonstration shows how sandbox environments can be used to observe malware behavior safely and consistently. The emphasis is on what behavioral signals matter for intelligence, not reverse engineering depth or tool mastery. Uses Cuckoo to provide a demo of protectected Malware analysis

This video teaches learners how to move from observed malware behavior to causal explanations. Learners explore how analysts infer adversary objectives, constraints, and tradecraft evolution without over-attributing intent or certainty.

This video introduces basic statistical reasoning relevant to threat intelligence, focusing on distributions, outliers, and trend interpretation. Learners explore how misapplied statistics can distort confidence and lead to false signals.

This demonstration shows how normalized data is aggregated into dashboards and visual outputs. Learners examine how visualization choices influence perception, prioritization, and executive interpretation of intelligence findings.

This video focuses on cognitive and data-driven bias introduced during collection and processing. Learners explore confirmation bias, survivorship bias, and tooling bias and how disciplined workflows mitigate their impact before analysis begins

Introduction to the section, key topics to be covered, and call to action.

This video introduces predictive analytic techniques used in intelligence to assess likely adversary actions and trajectories. Learners explore how analysts reason forward from observed behavior while explicitly managing uncertainty and avoiding overconfidence.

This video examines how adversary organizational structure, incentives, and constraints shape cyber operations. Learners analyze how hierarchy, resourcing, and mission objectives influence tradecraft consistency and variation.

This video focuses on assessing adversary technical capabilities without assuming sophistication equals intent. Learners explore how tooling choices reflect trade-offs, access, and operational priorities rather than technical prowess alone.

This video teaches learners how to identify analytically meaningful signals within large datasets. Learners explore how analysts distinguish enduring adversary behavior from environmental noise and opportunistic activity.

This demonstration shows how MITRE ATT&CK is used to structure TTP analysis and compare observed activity against known patterns. The focus is on analytic alignment, not coverage metrics or checklist thinking.

This video demonstrates how intelligence teams translate TTP analysis into concrete defensive and operational use cases. Learners see how analytic conclusions inform detection logic, prioritization, and response planning. Uees the MITRE ATT&CK Navigator

This video teaches learners how to directly answer intelligence requirements without unnecessary technical detail. Emphasis is placed on clarity, relevance, and alignment to decision-maker needs.

This demonstration shows how analysts express confidence levels using probabilistic language and evidence weighting. Learners explore how confidence framing affects credibility and downstream decision-making. Includes Cuckoo to show how confidence alters with tools

This video focuses on identifying intelligence gaps and future collection requirements. Learners explore how good intelligence products create feedback loops that strengthen the overall intelligence cycle.