Cyber Threat Intelligence (CTI) 101: Beginner’s Guide (2025)

A practical, beginner-friendly guide to Cyber Threat Intelligence with real-world use cases.

What you'll learn
- Understand the fundamentals of Cyber Threat Intelligence (CTI) and its importance in modern cybersecurity.
- Explore the CTI lifecycle including direction, collection, processing, analysis, and dissemination.
- Identify and differentiate between strategic, operational, tactical, and technical threat intelligence.
- Learn to use top CTI tools like MISP, VirusTotal, and others to gather and analyze threat data.
- Learn how to build and operationalize threat intelligence using Microsoft Sentinel, integrating CTI into a modern SOC environment.
- Understand how CTI supports SOC operations, incident response, and proactive threat hunting.

Requirements
- Willingness to learn and explore real-world cyber threats and intelligence tools.

Description
Are you ready to dive into the world ofCyber Threat Intelligence (CTI)and buildjob-ready skillsin one of the most in-demand areas of cybersecurity?

Thisbeginner-friendly courseis designed to give you a clear, hands-on understanding of how Cyber Threat Intelligence works, how it supportsSecurity Operations Centers (SOCs), and how you can start usingreal-world tools and platforms like Microsoft Sentinel and MISPto collect, process, and act on threat data. You’ll also gain insights intoTTPs (Tactics, Techniques, and Procedures)used by adversaries and how CTI helps detect and defend against them.

What You’ll Learn:

Section 1: Introduction to CTI

Understand what CTI is and why it’s critical to modern cybersecurity.

Learn through real-world analogies that make complex topics easy to grasp.

Section 2: CTI Lifecycle Explained

Follow the CTI lifecycle: Direction, Collection, Processing, Analysis, and Dissemination.

Learn how each phase supports threat detection and enables a proactive defense strategy.

Section 3: Types of Threat Intelligence

Dive into the four core types:Strategic, Tactical, Operational, and Technicalintelligence.

Understand how to apply them based on organizational needs and threat landscapes.

Section 4: Labs – Threat Intelligence in Microsoft Sentinel

Set up yourMicrosoft Azureenvironment and deployMicrosoft Sentinel.

ConfigureLog Analytics, explore theContent Hub, and integratethreat intelligence feedsincludingTTPs and IOCs.

Learn how to operationalize CTI in a cloud-native SOC platform.

Section 5: Tools Every Analyst Should Know

Explore thetop 5 threat intelligence tools, includingMISPfor threat sharing and enrichment.

See how these tools help track, analyze, and defend against real-world attacks using knownTTPs.

Who this course is for:
- Beginners who are curious about cybersecurity and want to understand how threat intelligence works.
- Students or recent graduates aiming to enter the cybersecurity field.
- IT professionals looking to pivot into threat intelligence or enhance their security knowledge.
- SOC analysts or blue teamers seeking to build a foundation in CTI and integrate Microsoft Sentinel.
More Info