Producing & Sharing Threat Intelligence

What you will be able to do

• You will be able to write a finished intelligence product using Bottom Line Up Front (BLUF) structure, so the key judgment lands in the first two lines
• You will be able to tailor the same core assessment for tactical, operational, and strategic audiences without losing accuracy
• You will be able to express uncertainty honestly using estimative language and calibrated confidence levels
• You will be able to reason through an attribution question, separating observed facts from assessments, and describe adversary behavior with MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge)
• You will be able to package and share indicators as machine-readable intelligence using STIX and TAXII
• You will be able to contribute to and consume a MISP community, and apply the Traffic Light Protocol (TLP) to control who sees what
• You will be able to choose the right product format for the moment, from a fast flash alert to a longer strategic threat assessment
• You will be able to brief technical and executive stakeholders, handle their questions, and use a Request for Information (RFI) and feedback to make the next product better

What is inside

4 modules, 8 lessons. Each module ends in a graded quiz and most carry an assignment.

1. 01

   Writing Finished Intelligence

   This module covers the craft of turning analysis into a finished product a reader can act on. You will learn to lead with the bottom line, write for tactical, operational, and strategic audiences, and keep facts clearly separate from your own assessments. You will also learn to express uncertainty honestly using estimative language and calibrated confidence levels.

   2 lessons · 5 quiz questions

2. 02

   Attribution Reasoning

   Attribution is one of the hardest judgments an analyst makes and one of the easiest to get wrong. This module teaches you to reason from evidence to a defensible conclusion, guard against common cognitive biases, and describe adversary behavior in shared language. You will practice structured techniques and learn to communicate how confident you are and why.

   2 lessons · 5 quiz questions · assignment

3. 03

   Machine-Readable Sharing: STIX, TAXII, and MISP

   Some intelligence must move faster than any human can read it. This module teaches machine-readable sharing: modeling threats with STIX (Structured Threat Information eXpression), moving them between systems with TAXII (Trusted Automated eXchange of Intelligence Information), and collaborating in a MISP (Malware Information Sharing Platform) community. You will learn to attach context to indicators, control distribution with the Traffic Light Protocol, and keep shared data useful as it ages.

   2 lessons · 5 quiz questions

4. 04

   Dissemination and Briefing Stakeholders

   A threat intelligence product only creates value when the right people read it, understand it, and act on it. This module walks through the full dissemination step: choosing the right format for the moment, matching your message to technical and executive audiences, and briefing it out loud with confidence. You will also learn to run the feedback loop that makes each product sharper than the last, from intake requests to honest impact metrics.

   2 lessons · 5 quiz questions · assignment