This module focuses on how threat intelligence teams collect, process, and normalize data in ways that support analytic judgment rather than overwhelm it. Learners examine open-source intelligence, malware-derived data, and large-scale datasets, with emphasis on source evaluation, signal filtering, and bias management. The module highlights the tradeoffs between speed, depth, and reliability, and demonstrates how improper processing can distort downstream analysis. By the end of this module, learners will understand how disciplined collection and processing create the conditions for credible intelligence assessment.

This module focuses on how threat intelligence teams analyze collected data and assess attribution with discipline and confidence. Learners apply structured analytic techniques to evaluate adversary behaviour, map TTPs, and distinguish evidence from assumptions. The module emphasizes probabilistic reasoning, confidence levels, and analytic transparency—particularly where attribution carries operational or strategic risk. By the end of this module, learners will be able to produce defensible intelligence judgments that withstand scrutiny from both technical and executive stakeholders.

This module focuses on turning threat intelligence into measurable, operational impact across detection, response, and decision-making workflows. Learners examine how intelligence informs threat hunting, defensive architecture, and program governance while navigating legal, ethical, and organizational constraints. The module emphasizes effectiveness over activity, teaching learners how to measure success, identify gaps, and communicate value to stakeholders. By the end of this module, learners will be prepared to integrate intelligence into real operational environments and continuously evolve their intelligence programs.