Threat Intelligence

Threat Intelligence: Concepts and Practice is a practical, end-to-end guide to cyber threat intelligence (CTI) for SOC analysts, security engineers, and managers who understand security operations but have never formally worked inside a CTI function.

The book starts with the vocabulary that everything else depends on: the difference between data, information, and intelligence. From there it walks through the six-phase intelligence lifecycle, the four levels of intelligence (strategic, operational, tactical, and technical), and the Pyramid of Pain, which shows exactly which indicators are worth an analyst's time. It then builds the technical scaffolding: MITRE ATT&CK, threat actor categorization and attribution, collection sources, and the sharing standards that make modern CTI possible, including STIX 2.1, TAXII 2.1, MISP, and TLP 2.0.

The second half moves from concept to craft. Readers learn structured analytical techniques such as the Diamond Model and Analysis of Competing Hypotheses, how to operationalize indicators across a SIEM, EDR, firewall, DNS resolver, and mail gateway, how to run intelligence-driven threat hunts using KQL and Sigma, and how to build a CTI program from the ground up, complete with a charter, a maturity model, team roles, and metrics that actually measure impact.

Every concept is anchored in a concrete artifact: real STIX JSON objects, Sigma rules, ATT&CK Navigator layers, and TLP-marked report snippets. A single worked example traces one phishing campaign from a raw indicator collected on a Tuesday morning all the way through enrichment, blocking, hunting, and a strategic report read by the CISO, so readers see the entire discipline connected, start to finish, not just described in pieces.