Course · NCTI
NSD Certified Threat Intelligence Program
From raw data to intelligence defenders can act on.
A course by the Cybersecurity & AI Initiative, an ISAC Foundation centre.
- Length
- 52 hours
- Format
- Three modules: eight live instructor-led sessions of three hours, with hands-on exercises and case studies
- Certification
- NSD certification; an eight-hour examination, two attempts
- Before you start
- NCBIS, or equivalent networking and security knowledge
About the course
A programme that teaches learners to turn raw security data into actionable intelligence: the intelligence cycle, adversary tradecraft, collection and analysis, MITRE ATT&CK, the Kill Chain and the Diamond Model, threat-intelligence platforms and automation, and writing and sharing intelligence. Learners practise on case scenarios and finish with an applied intelligence report.
What you become
A threat-intelligence analyst who can profile adversaries, enrich indicators and turn intelligence into detections and hunts.
Who it is for
- SOC analysts and incident responders
- Threat hunters and detection engineers
- CERT, CSIRT and security-operations staff
- Security analysts and risk teams
- Law-enforcement and investigation personnel
- Students and professionals moving into threat intelligence
Curriculum
Foundation and OSINT
Intelligence types, lifecycle, sources, adversary profiling, sharing
Threat-intelligence types, lifecycle and outcomes; OSINT sources such as VirusTotal, OTX, Shodan, Censys and WHOIS; passive and active collection and validation; adversary profiling, tracking and ethics; sharing through MISP, OpenCTI and STIX/TAXII.
Indicators, TTPs and automation
IOCs and IOAs, MITRE ATT&CK, YARA, enrichment, Python
IOCs versus IOAs; TTPs and MITRE ATT&CK mapping; YARA for malware detection; collecting, structuring and correlating threat data; STIX/TAXII, feeds, APIs and enrichment; Python automation for IOC lookups and feed processing.
Threat hunting and reporting
Hypotheses, log analysis, Sigma and KQL, intelligence reports
Hypothesis-, IOC- and TTP-based hunting; analysing Sysmon, DNS, firewall, proxy and authentication logs; detection engineering with Sigma and KQL; writing intelligence reports with confidence and attribution caveats; sharing IOCs in STIX, JSON and CSV.
What is included
- Practical exercises on threat-intelligence platforms, ATT&CK mapping, indicator enrichment and report writing
- Tools: MISP, OpenCTI, MITRE ATT&CK Navigator, YARA, Sigma, passive-DNS and sandbox services
Enrol
Send an enquiry to the Cybersecurity & AI Initiative from this page.