Name: Cyber Threat Intelligence: Building and Running an Intel Function Course
Price: 1049.0 USD
Availability: InStock

This course includes

12 hours of live, project-based training from experts
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 1.2 CEUs
Small class sizes

Cyber threat intelligence is often taught as a set of hunting techniques. This course treats it as the broader discipline that hunting sits inside, covering the full intelligence lifecycle.

Learners set intelligence requirements, evaluate sources, apply the Diamond Model and MITRE ATT&CK, and package findings for different audiences, applying the Traffic Light Protocol before sharing. The course closes with how intelligence is routed to hunting and incident response teams. No hands-on lab is required.

This course has a prerequisite

Familiarity with basic networking and security operations concepts, equivalent to Networking Fundamentals for Security.

Schedule & Enrollment: Cyber Threat Intelligence: Building and Running an Intel Function Course

12 Hours
Full tuition: $1,049
Live Online
Free retake
Expert instructors
Small classes

Policies

Dates & times are listed in

Self-Paced More details

Start anytime Online only
Jan 12–13

Tuesday to Wednesday 9am–4:30pm

Live Online

G
Jun 14–15

Monday to Tuesday 9am–4:30pm

Live Online

G
Sep 9–10

Thursday to Friday 9am–4:30pm

Live Online

G

Tuition

Full Tuition

$1,049
Due before the class starts

This course includes

12 hours of live, project-based training from experts
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 1.2 CEUs
Small class sizes

Learning Experience Highlights

Training from government‑experienced instructors

Receive instruction from subject‑matter experts who bring proven government experience.

Specialized for government & DoD

Courses that are regularly updated based on feedback and industry developments, ensuring versions are mapped to federal competencies.

The instructor was wonderful and so knowledgeable. The course materials were extremely relevant to what my job is. I feel like I can be better because of this class.
— 2025 student

Three professionals sit in black chairs with laptops and notebooks, engaged in conversation against a red wall.

Real-world solutions

Directly addressing the day-to-day challenges of federal employees.

125+ departments & agencies served

Your trusted training partner, equipping public service professionals with the skills and knowledge to excel in their roles and drive meaningful impact.

Interactive Training

Attend this course live online or as self-paced training. Engage with expert instructors, ask questions, and get feedback on your exercises and projects.

Live Online Remote, from anywhere

Get the same interactivity and access to the instructor as in-person students. There are no extra fees and we’ll work with you to ensure your remote setup is perfect.

Live, interactive class
Experienced instructor teaching live online
Remote setup assistance provided

Self-Paced Remote, from anywhere

Learn at your own pace with pre-recorded video lessons and hands-on exercises. Work through the material on your schedule with access to course content and resources.

Learn on your own with access to an instructor for questions
24/7 access to premium course videos
Hands-on exercises and projects

A bright Graduate School USA lounge area with modern chairs, red ottomans, and collaborative work tables.

Professionals hold a discussion with laptops and notes in a Graduate School USA lounge area.

A woman wearing headphones participates in a government training class over video conference, with multiple faces visible on her screen.

Earn a Certificate of Completion

Upon completion of this course, you’ll receive an official certificate testifying to your mastery of the curriculum. We’ll send you a link where you can download your certificate, share it online with your friends, post it to your professional network on LinkedIn, and view all your earned certificates. Congratulations on your achievement!

Shareable on

Sample credential for completion of Cyber Threat Intelligence: Building and Running an Intel Function Course

Free Retake

Missed a session or need a refresher? We have you covered!

Free Retake

We offer a single free retake of the class within a year.

See terms and conditions.

A group of adult learners sits in a classroom, smiling and engaged in a government training session.

A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.

A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Cyber Threat Intelligence: Building and Running an Intel Function Course Curriculum

What You'll Learn at a Glance

Explain how cyber threat intelligence differs from threat hunting and where each fits in a security program.
Set intelligence requirements that reflect an organization's actual risks and decision needs.
Evaluate open source, technical, and closed source collection sources for reliability and relevance.
Apply structured analytic techniques, including the Diamond Model of Intrusion Analysis, to reduce analytic bias.
Map adversary behavior to the MITRE ATT&CK framework to support consistent analysis and reporting.
Assign confidence levels to intelligence judgments and communicate uncertainty clearly.
Write intelligence products suited to executive, operational, and tactical audiences.
Apply the Traffic Light Protocol to control how shared intelligence is handled and redistributed.
Identify the information-sharing bodies and mechanisms relevant to a given sector.
Design the staffing, tooling, and workflow of a cyber threat intelligence function.
Select metrics that show whether an intelligence function is producing usable analysis.
Route finished intelligence to threat hunting, incident response, and vulnerability management teams so it drives action.
Build a feedback loop that keeps intelligence requirements current as the threat environment changes.

Course Syllabus

Download Syllabus PDF

Module 1: Foundations of Cyber Threat Intelligence

Lessons:
- What Cyber Threat Intelligence Is and Is Not
- The Four Levels of Intelligence: Strategic, Operational, Tactical, Technical
- Threat Intelligence and Threat Hunting: Parent and Consumer
- The Intelligence Lifecycle at a Glance
Applied activity: Learners sort a set of sample intelligence products, such as an executive briefing, a SOC alert, an indicator feed, and a hunting hypothesis, by intelligence level and justify each placement.

Module 2: Planning and Collection

Lessons:
- Setting Intelligence Requirements
- Open Source and Technical Collection
- Closed Source and Commercial Feeds
- Evaluating Collection Sources
Applied activity: Learners draft a set of priority intelligence requirements for a hypothetical organization and select which collection sources would satisfy each requirement.

Module 3: Processing and Analysis

Lessons:
- Structured Analytic Techniques
- The Diamond Model of Intrusion Analysis
- Mapping Adversary Behavior to MITRE ATT&CK
- Confidence Levels and Analytic Bias
Applied activity: Learners take a short incident narrative, plot it on the Diamond Model, map the observed behavior to MITRE ATT&CK, and assign a confidence level to their conclusion.

Module 4: Dissemination and Sharing

Lessons:
- Writing Intelligence Products for Different Audiences
- The Traffic Light Protocol
- Information Sharing Organizations and Mechanisms
- Handling Sensitive and Shared Intelligence
Applied activity: Learners take one analytic finding from Module 3 and produce two versions of it, an executive summary and a technical bulletin, each correctly labeled with a Traffic Light Protocol marking.

Module 5: Building and Running the Intel Function

Lessons:
- Team Structure and Roles
- Threat Intelligence Platforms and Tooling
- Integrating Intelligence with the Security Program
- Measuring Program Value
Applied activity: Learners sketch a staffing and workflow plan for a small intelligence function supporting a stated organization, including how intelligence reaches the security operations center.

Module 6: From Intelligence to Action

Lessons:
- Handing Intelligence to Threat Hunting
- Handing Intelligence to Incident Response
- The Hunting Ladder as One Consumer of Intelligence
- Closing the Feedback Loop and Maturing the Function
Applied activity: Learners take the finished intelligence product from Module 4 and draft one hunting hypothesis and one incident response question it should answer, then propose a feedback update to the original intelligence requirement.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts

Installments
	10% non-refundable deposit
$1,049.00	Total You Pay