Name: Cyber Threat Intelligence: Building and Running an Intel Function Course (Self-Paced)
Price: 1049.0 USD
Availability: InStock

This course includes

10 hours of project-based training from experts
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 1 CEU

This course is self-paced. For live online or in-person instruction, take Cyber Threat Intelligence: Building and Running an Intel Function Course.

Cyber threat intelligence is often taught as a set of hunting techniques. This course treats it as the broader discipline that hunting sits inside, covering the full intelligence lifecycle.

Learners set intelligence requirements, evaluate sources, apply the Diamond Model and MITRE ATT&CK, and package findings for different audiences, applying the Traffic Light Protocol before sharing. The course closes with how intelligence is routed to hunting and incident response teams. No hands-on lab is required.

This course has a prerequisite

Familiarity with basic networking and security operations concepts, equivalent to Networking Fundamentals for Security.

Tuition

Full Tuition

$1,049
Due before the class starts

This course includes

10 hours of project-based training from experts
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 1 CEU

Learning Experience Highlights

Training from government‑experienced instructors

Receive instruction from subject‑matter experts who bring proven government experience.

Specialized for government & DoD

Courses that are regularly updated based on feedback and industry developments, ensuring versions are mapped to federal competencies.

The instructor was wonderful and so knowledgeable. The course materials were extremely relevant to what my job is. I feel like I can be better because of this class.
— 2025 student

Three professionals sit in black chairs with laptops and notebooks, engaged in conversation against a red wall.

Real-world solutions

Directly addressing the day-to-day challenges of federal employees.

125+ departments & agencies served

Your trusted training partner, equipping public service professionals with the skills and knowledge to excel in their roles and drive meaningful impact.

100% Online. Start Anytime

24/7 access to our premium course videos and projects.
Industry experts are assigned as your course instructor. Message your instructor with any questions.
Participate in GSUSA online discussion forums — share ideas and receive additional support.
Hands-on quizzes and mini projects to test and reinforce concepts.

Earn a Certificate of Completion

Upon completion of this course, you’ll receive an official certificate testifying to your mastery of the curriculum. We’ll send you a link where you can download your certificate, share it online with your friends, post it to your professional network on LinkedIn, and view all your earned certificates. Congratulations on your achievement!

Shareable on

Sample credential for completion of Cyber Threat Intelligence: Building and Running an Intel Function Course (Self-Paced)

A group of adult learners sits in a classroom, smiling and engaged in a government training session.

A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.

A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Cyber Threat Intelligence: Building and Running an Intel Function Course (Self-Paced) Curriculum

What You'll Learn at a Glance

Explain how cyber threat intelligence differs from threat hunting and where each fits in a security program.
Set intelligence requirements that reflect an organization's actual risks and decision needs.
Evaluate open source, technical, and closed source collection sources for reliability and relevance.
Apply structured analytic techniques, including the Diamond Model of Intrusion Analysis, to reduce analytic bias.
Map adversary behavior to the MITRE ATT&CK framework to support consistent analysis and reporting.
Assign confidence levels to intelligence judgments and communicate uncertainty clearly.
Write intelligence products suited to executive, operational, and tactical audiences.
Apply the Traffic Light Protocol to control how shared intelligence is handled and redistributed.
Identify the information-sharing bodies and mechanisms relevant to a given sector.
Design the staffing, tooling, and workflow of a cyber threat intelligence function.
Select metrics that show whether an intelligence function is producing usable analysis.
Route finished intelligence to threat hunting, incident response, and vulnerability management teams so it drives action.
Build a feedback loop that keeps intelligence requirements current as the threat environment changes.

Course Syllabus

Download Syllabus PDF

Module 1: Foundations of Cyber Threat Intelligence

Lessons:
- What Cyber Threat Intelligence Is and Is Not
- The Four Levels of Intelligence: Strategic, Operational, Tactical, Technical
- Threat Intelligence and Threat Hunting: Parent and Consumer
- The Intelligence Lifecycle at a Glance
Applied activity: Learners sort a set of sample intelligence products, such as an executive briefing, a SOC alert, an indicator feed, and a hunting hypothesis, by intelligence level and justify each placement.

Module 2: Planning and Collection

Lessons:
- Setting Intelligence Requirements
- Open Source and Technical Collection
- Closed Source and Commercial Feeds
- Evaluating Collection Sources
Applied activity: Learners draft a set of priority intelligence requirements for a hypothetical organization and select which collection sources would satisfy each requirement.

Module 3: Processing and Analysis

Lessons:
- Structured Analytic Techniques
- The Diamond Model of Intrusion Analysis
- Mapping Adversary Behavior to MITRE ATT&CK
- Confidence Levels and Analytic Bias
Applied activity: Learners take a short incident narrative, plot it on the Diamond Model, map the observed behavior to MITRE ATT&CK, and assign a confidence level to their conclusion.

Module 4: Dissemination and Sharing

Lessons:
- Writing Intelligence Products for Different Audiences
- The Traffic Light Protocol
- Information Sharing Organizations and Mechanisms
- Handling Sensitive and Shared Intelligence
Applied activity: Learners take one analytic finding from Module 3 and produce two versions of it, an executive summary and a technical bulletin, each correctly labeled with a Traffic Light Protocol marking.

Module 5: Building and Running the Intel Function

Lessons:
- Team Structure and Roles
- Threat Intelligence Platforms and Tooling
- Integrating Intelligence with the Security Program
- Measuring Program Value
Applied activity: Learners sketch a staffing and workflow plan for a small intelligence function supporting a stated organization, including how intelligence reaches the security operations center.

Module 6: From Intelligence to Action

Lessons:
- Handing Intelligence to Threat Hunting
- Handing Intelligence to Incident Response
- The Hunting Ladder as One Consumer of Intelligence
- Closing the Feedback Loop and Maturing the Function
Applied activity: Learners take the finished intelligence product from Module 4 and draft one hunting hypothesis and one incident response question it should answer, then propose a feedback update to the original intelligence requirement.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts

Installments
	10% non-refundable deposit
$1,049.00	Total You Pay