What this book covers
Chapter 1, Why You Need a Threat Intelligence Program, is where you will learn the fundamentals of what threat intelligence is, how it differs from data, and what constitutes good threat intelligence.
Chapter 2, Threat Actors, Campaigns, and Tooling, is where we examine the varying types of threat actors, their behaviors and approaches to committing attacks, their motivations, and the associated tactics, techniques, and procedures (TTPs) utilized in their attack chain.
Chapter 3, Guidelines and Policies, is where you will be introduced to the needs and benefits of the various guidelines, procedures, standards, and policies that should be introduced into a cyber threat intelligence program.
Chapter 4, Threat Intelligence Frameworks, Standards, Models, and Platforms, is where you will examine threat models, frameworks, and standards to help organize, structure, and facilitate sharing, analysis, and the understanding of threat intelligence data and information with stakeholders.
Chapter 5, Operational Security (OPSEC), covers fundamental considerations to operational security (OPSEC) when conducting investigations. While not all-encompassing, these considerations can be helpful for new threat intelligence professionals. We wrap the chapter up by examining collections operations.
Chapter 6, Technical Threat Intelligence – Collection, is where you will examine the second phase of the intelligence life cycle, the collection phase. We'll look into what collection is, the collection management process, the role of the collection manager, and the collections operations life cycle.
Chapter 7, Technical Threat Analysis – Enrichment, covers technical threat intelligence enrichment and analysis, which examines the process of adding context to threat intelligence data and enhancing or improving that data by performing actions such as removing false positives or incorrect intelligence data.
Chapter 8, Technical Threat Analysis – Threat Hunting and Pivoting, is where we examine hunting and pivoting on threat data from collection operations to see whether the related malicious activity can be identified. We will also look into several hunting and pivoting methods, as well as introducing you to several tools and services that could be used to assist you with performing these types of operations.
Chapter 9, Technical Threat Analysis – Similarity Analysis, is where we introduce the concept of using graph theory with similarity grouping, in addition to introducing you to several similarity grouping tools. Finally, we introduce you to the concept of using tools to cluster infrastructure or files.
Chapter 10, Preparation and Dissemination, is where we focus on how to interpret the collected data, evaluate it for intelligence, and identify portions that should be considered timely, accurate, and relevant threat intelligence. Special focus in this chapter is placed on interpretation and alignment, critical thinking and reasoning, tagging, and considerations relating to threat intelligence.
Chapter 11, Fusion into Other Enterprise Operations, covers key stakeholders of the organization that would consume the threat intelligence, why, and for what purpose. This chapter examines the distinct considerations for using threat intelligence throughout several organizational units.
Chapter 12, Overview of Datasets and Their Practical Application, establishes an example threat intelligence collection, analysis, and production scenario that is used to walk through each of the phases of the intelligence life cycle to ensure that you get some hands-on practice in each phase as it applies to the real-world scenario.
Chapter 13, Conclusion, is where we wrap up everything we discussed previously and highlight how each of the previous chapters is part of the intelligence life cycle and how they fit into the cyclical process of operationalizing threat intelligence.