Threat Intelligence Analyst

A raw IP address in a log file is data. Knowing that IP address was seen beaconing from a compromised host is information. Knowing that the IP belongs to infrastructure a specific ransomware affiliate rotates every few weeks, and what that means for how long a block list entry stays useful, is intelligence. Threat intelligence is the product of analysis: evidence-based knowledge, including context, mechanisms, indicators and implications, about an existing or emerging threat, produced to support a decision. If a report does not help someone decide something — block a domain, brief an executive, prioritise a patch, change a control — it is not really intelligence yet, no matter how many indicators it contains.

CTI is usually described at three levels. Strategic intelligence is long-range and non-technical, aimed at executives and boards: which threat actors and trends matter to this organisation's sector and geography over the next year, and what should that mean for budget and risk appetite. Operational intelligence sits in the middle, tracking specific campaigns, actor TTPs and infrastructure over weeks and months, and is consumed by security managers and incident responders planning defences. Tactical (sometimes called technical) intelligence is the most granular and short-lived: the IOCs, signatures and detection content that SOC analysts load into SIEM and EDR tooling today. A mature CTI function produces all three, because a board member and a SOC analyst need answers to different questions from the same underlying threat.

Almost every intelligence discipline, from military intelligence to CTI, is organised around the same six-phase cycle. It is drawn as a loop because the output of one run feeds the requirements of the next.

• •Direction (Planning & Direction) — stakeholders define Priority Intelligence Requirements (PIRs): the specific questions intelligence needs to answer, such as "are we likely to be targeted by initial access brokers selling VPN access in our sector?"
• •Collection — analysts gather raw data against those requirements from OSINT, closed sources, telemetry, paid feeds and internal logs
• •Processing — raw collection is normalised, deduplicated, decrypted, translated or otherwise converted into a form analysts can work with
• •Analysis (Analysis & Production) — analysts evaluate, correlate and interpret processed information to produce an assessment that answers the original requirement
• •Dissemination — the finished product is delivered to the stakeholder who asked for it, in a format and at a classification they can use
• •Feedback — stakeholders tell the CTI function whether the product answered the question, which reshapes the next cycle's requirements

Programmes that skip the Direction phase tend to collect whatever is easiest — usually a firehose of open-source IOC feeds — and call the resulting noise "intelligence." Well-run CTI functions start every cycle from a small set of PIRs owned by named stakeholders, and they measure success by whether those stakeholders made better decisions, not by feed volume or indicator counts. The rest of this course follows the cycle in order: collection tradecraft, analytic technique, and the platforms and standards used to process, structure and disseminate the result.