Cyber threat intelligence (CTI) aims to provide valuable
intelligence to help organizations be aware of and protect
against cyber-attacks. This course provides students with a hands-
on introduction to the fundamental concepts and tools of cyber
threat intelligence.
Additional Requirements for Graduate Students: In addition to the undergraduate requirements, graduate students
will complete a paper that thoroughly analyzes and critiques a
case study in cyber threat intelligence.
Athena Title
Cyber Threat Intelligence
Undergraduate Pre or Corequisite
MIST 4600 or MIST 4600E
Semester Course Offered
Offered fall and spring
Grading System
A - F (Traditional)
Student learning Outcomes
Students will analyze and interpret complex cyber threat data using quantitative, computational, and analytical techniques (e.g., data mining, event correlation, visualization) to identify trends and assess threat severity.
Students will design and implement components of the cyber threat intelligence (CTI) lifecycle, including the collection, aggregation, and dissemination of intelligence using tools such as STIX,TAXII, and SIEM.
Students will evaluate and communicate actionable intelligence findings to both technical and managerial audiences through written reports and oral presentations.
Students will collaborate effectively in teams to develop and present comprehensive cyber threat intelligence strategies that address organizational security needs.
Students will assess the ethical, legal, and societal implications of cyber threat intelligence practices and apply responsible decision-making in cybersecurity operations.
Topical Outline
Topic 1: Cyber Threat Intelligence Introduction and Intelligence Strategy
• Fundamental cyber threat intelligence concepts and vocabulary
• Intelligence lifecycles
• Threat trending
• Critical asset identification
• Indicators of compromise (IoC’s)
• Modeling threat scenarios for an organization (diamond modelling)
• Intelligence buy-in
Topic 2: Intelligence Collection, Aggregation, and Capabilities
• Identifying intelligence sources and feeds
• Collecting and aggregating open source intelligence using web mining techniques
• Collecting and aggregating internal intelligence
• Intelligence formats (e.g., STIX, TAXII, CybOX, MAEC, CAPEC)
• Setting up collective intelligence framework (CIF) and
trusted automated eXchange of intelligence Information (TAXII) servers
• Security information and event management (SIEM)
• Big Data technologies (Hadoop and Spark) for CTI data aggregation and processing
Topic 3: Threat Analytics and Reporting
• Lockheed Martin cyber kill chain
• Internal and external hacker profiling and tracking
• Fundamental CTI analytics: summary statistics, event correlation, reputation, malware analysis, anomaly detection, forensics
• Threat analytics utilizing machine learning and text mining approaches
• Network science applications for cyber threat intelligence applications
• Threat data visualizations and dashboards
Topic 4: Operational Intelligence
• Actionable intelligence
• Courses of action
• Proactive defense
• Threat dissemination and intelligence sharing
• Intelligence strategy, process, and systems review
