Threat Intelligence and OSINT
Collect, analyse and act on intelligence — ethically and legally.
Taught by Nisha Poudel · SOC Lead
What you'll learn
- Distinguish strategic, operational, and tactical threat intelligence
- Run the intelligence lifecycle from requirements through dissemination
- Collect open-source intelligence with mainstream tools, safely and legally
- Work with indicators of compromise and attacker tactics and techniques
- Map adversary behaviour to the MITRE ATT&CK framework
- Share intelligence with STIX, TAXII, and the Traffic Light Protocol
About this course
Threat intelligence turns scattered signals about attackers into decisions defenders can act on, and this intermediate course teaches the full craft. It is for security analysts, SOC team members, and investigators who want to collect, analyse, and share intelligence properly. You will learn the difference between strategic, operational, and tactical intelligence, run the intelligence lifecycle, and collect open-source intelligence, OSINT, with mainstream tools. You will work with indicators of compromise and attacker tactics, techniques, and procedures, map adversary behaviour to MITRE ATT&CK, and share findings using STIX, TAXII, and the Traffic Light Protocol. A strong thread throughout is ethics and legality: what you may and may not do, how to protect sources and yourself, and how to stay within the law. Basic security knowledge and comfort with the command line will help you get the most from the hands-on lessons.
Course content
7 lessons- 1What Threat Intelligence IsThe three levels of intelligence and the difference between raw data and finished analysis.Preview
- 2The Intelligence LifecycleThe repeatable cycle from requirements through collection, analysis, and dissemination.
- 3OSINT Collection: Sources and ToolingGathering open-source intelligence safely with mainstream tools and good tradecraft.
- 4Indicators, TTPs, and the Pyramid of PainWhy attacker behaviour is more valuable to defenders than easily changed indicators.
- 5Mapping to MITRE ATT&CKUsing the ATT&CK framework as a shared language for adversary behaviour and defensive gaps.
- 6Sharing Intelligence: STIX, TAXII, and TLPStructured formats and handling rules for exchanging intelligence with others.
- 7Ethics, Legality, and Operational SecurityStaying within the law, protecting sources and yourself, and reporting responsibly.