Cyber Threat Intelligence & Incident Response
Course Description
The Cyber Threat Intelligence & Incident Response course equips learners with the knowledge and skills to identify, assess, and mitigate cyber threats effectively. Participants will explore how to gather and analyze threat intelligence, monitor network activities for suspicious behavior, and respond to security incidents in a structured and timely manner. The course covers critical topics such as malware analysis, digital forensics, threat hunting, and security operations. By the end of the training, learners will be able to develop incident response plans, use intelligence-driven defense strategies, and strengthen an organization’s resilience against cyberattacks.
Course Curriculum
- Threat Intelligence Cycle: Direction, Collection, Processing, Analysis, Dissemination
- Sources of Threat Intelligence (Open-Source, Closed, Commercial, Dark Web)
- Intelligence Requirements and Prioritization
- Indicators of Compromise (IOCs) and Tactics, Techniques & Procedures (TTPs)
- Automation in Threat Intelligence
- Collect and process threat intelligence using open-source tools (MISP, AlienVault OTX)
- What is Incident Response?
- Stages of Incident Response (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned)
- Roles and Responsibilities of IR Teams
- Importance of IR Policies and Playbooks
- Key Metrics and KPIs in Incident Response
- Develop a sample incident response plan for a simulated company
- Designing an Effective CTI and IR Framework
- Aligning with Industry Standards (NIST, ISO 27035, SANS)
- Policy Development and Governance
- Incident Simulation and Tabletop Exercises
- Developing a Continuous Improvement Strategy
- Hands-on Project: Design a CTI and IR architecture for an enterprise organization