What is CTI, actually?
Cyber Threat Intelligence (CTI) is the practice of studying the people and groups trying to break into networks: who they are, how they operate, and what they're after. Understanding that helps an organization make smarter security decisions instead of just reacting to whatever's on fire that day. A CTI analyst collects information about threats, figures out what actually matters to their org, and turns it into something a decision-maker can act on: a report, a briefing, a set of recommendations.
It's less “stopping the hack in real time” (that's the SOC's job) and more “understanding the adversary well enough to help everyone else make better calls.” The work follows a loop: figure out what you need to know, collect it, make sense of it, share it, get feedback, and do it all again. It's usually called the Intelligence Cycle. More on that below.
New term you don't recognize anywhere on this site? Check the Glossary.
TL;DR: CTI is about understanding who and why, not just what happened.
Would you enjoy CTI day to day?
You might enjoy CTI if you…
- Like research and writing more than firefighting
- Enjoy connecting dots across scattered, incomplete information
- Want to understand why an attack happened, not just patch it and move on
- Don't mind that most of the job is analysis and communication, not hands-on-keyboard defense
- Are comfortable being wrong sometimes and revising your assessment as new information comes in
If that sounds appealing, keep going, you're in the right place. If it sounds tedious, don't count yourself out yet. Plenty of people who love this field felt exactly that way starting out. It's just worth knowing what the day-to-day actually looks like before you dive in headfirst.
Frameworks you'll keep hearing about
MITRE ATT&CK
Enterprise ATT&CK is definitely a framework that want to understand. Not memorize, but understand. MITRE also has other frameworks. You may hear people just refer to just MITRE, but dont be those people! Use what framework you're actually discussing. I'll get off my soapbox now. MITRE ATT&CK is a massive, community-maintained knowledge base of real-world adversary tactics and techniques: basically a shared vocabulary for describing how attackers operate, from initial access to exfiltration. When someone says a group “uses T1566 (phishing),” they're speaking ATT&CK.
attack.mitre.org ↗The Diamond Model
A way to describe any intrusion using four connected points: the Adversary, their Infrastructure, their Capability (tools/malware), and the Victim. Pivoting from one point to another (new infrastructure, same malware, known adversary) is how analysts connect incidents that look unrelated at first glance.
See it applied to a real intrusion →Pyramid of Pain
A model ranking indicators by how much it actually hurts an adversary's campaign when you block them, from easy-to-change file hashes at the bottom, up through IPs, domains, and tools, to their TTPs (tactics, techniques, procedures) at the top, which are the hardest thing for an attacker to change. The higher up the pyramid you operate, the more you disrupt them.
Read David Bianco's original post ↗The Intelligence Cycle
The loop most CTI work runs on: Planning & Direction → Collection → Processing → Analysis → Dissemination → Feedback, then start again. Less rigid in practice than it sounds on paper, but it’s the shared mental model for how raw information becomes a useful intelligence product.
Your first IOC lookup
Five minutes, completely safe, and the fastest way to make any of this click.
EICAR is a test file the entire antivirus industry has agreed to flag as “detected,” on purpose. It isn't malware, it can't hurt anything, and nobody's going to yell at you for running it. It exists specifically so people can safely test how a security tool reacts to a threat.
- Get the official test file from eicar.org, or save this exact line into a plain
.txtfile yourself, it's public and meant to be copied: X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*- Head to VirusTotal and upload the file.
- Look at what comes back: how many engines flagged it, what they're calling it, and the community score.
That report (a hash, a detection ratio, and a list of vendor names) is a tiny version of the raw material a CTI analyst works with constantly. The actual job is turning that into something useful: here's what this means, and here's what we should do about it.
Heads up: if your own antivirus deletes the file the second you save it, that's not a bug, that's it working. You just watched local detection happen in real time, and you already have your answer.
You're not going to break anything, I promise! EICAR was made for this! Feel free to contact me if you have any questions! (And maybe... don't do this on your work laptop? Only do what your actual work policies allow, I don't want to be the reason you get a call from your SOC 😅)
Katie Nickels' CTI Self-Study Plan
A Cyber Threat Intelligence Self-Study Plan
The best, most comprehensive overview of Cyber Threat Intelligence in existence. From its history and beginnings to the philosophical discussion around attribution. It's the deep dive every CTI newcomer should read.
This is TRULY the single best resource for anyone entering CTI. Katie Nickels is one of the most respected practitioners in the field and this self-study plan reflects that. I'm a giant fan girl for a reason!
Getting Started in CTI: 4 Pieces of Advice
Another Katie Nickels piece from Red Canary, with practical, actionable advice on breaking into the field. Pairs perfectly with the self-study plan above.
Read the article →Ready to keep going? Check out the Trainings & Learning page for courses, or the Tools page for your first analyst toolkit.
Explore Trainings →