SOC104 · Threat Intelligence and the MITRE ATT&CK Framework

Categories: Cybersecurity
Wishlist Share

About Course

Turn threat intelligence into defensive action by understanding intelligence types, indicators and the MITRE ATT&CK framework, then mapping your detection coverage and gaps.

Build · 6 hours · 4 lessons, a lab, an assessed assignment and a portfolio piece

Who it is for

Analysts and IT professionals who want to prioritize defenses based on how real adversaries operate.

Prerequisites

Complete SOC103 or have experience reviewing security logs and alerts.

What you will be able to do

  • Differentiate strategic, operational and tactical threat intelligence and their consumers
  • Evaluate indicators of compromise using the Pyramid of Pain and source reliability
  • Map adversary behavior from a public advisory to MITRE ATT&CK tactics and techniques
  • Build an ATT&CK Navigator coverage layer that highlights detection gaps and priorities

Lessons

  • Lesson 1 · What threat intelligence is and who uses it
  • Lesson 2 · Indicators, behaviors and the Pyramid of Pain
  • Lesson 3 · Using MITRE ATT&CK for defense
  • Lesson 4 · Lab and assignment

Lab: Map a public advisory to ATT&CK and score your coverage

You read a public cybersecurity advisory about a ransomware group that targets small businesses and extract the techniques it describes. You build an ATT&CK Navigator layer marking those techniques, then score your own detection coverage for each using the Wazuh environment or a sample control list, and export the layer as JSON and an image.

Free tools: MITRE ATT&CK Navigator (free, in the browser), a recent public CISA or vendor advisory, and a spreadsheet

Assessed assignment

Write a threat-informed defense brief for a regional retail chain with twelve stores. Identify two threat groups or malware families relevant to retail and summarize them using public reporting. Map their techniques in ATT&CK Navigator, mark which ones the company can currently detect, and recommend the five detection or hardening improvements with the highest risk reduction. Cite your sources and rate their reliability.

Criterion Weight What excellent work looks like
Threat relevance and sourcing 25% Threats are clearly relevant to retail and supported by cited, reliability-rated public sources.
ATT&CK mapping accuracy 30% Techniques and sub-techniques are mapped correctly with evidence from the sources.
Coverage analysis 25% The Navigator layer honestly distinguishes detected, partially detected and missing coverage.
Prioritized recommendations 20% Five improvements are specific, feasible and ranked by risk reduction.

Portfolio piece

A threat-informed defense brief with an ATT&CK Navigator coverage layer.

Self-paced, 12-month access. Questions are answered in writing through the student panel. A completion record is issued when you finish the course.

Next step

Continue with SOC105 · Detection Engineering with SIEM Tools · 8 hours · $56.00

Continue to the next course

Prefer the whole program? Program in Security Operations & Threat Defense · $378.00 (10% less than buying the courses separately)

Show More

What Will You Learn?

  • Differentiate strategic, operational and tactical threat intelligence and their consumers
  • Evaluate indicators of compromise using the Pyramid of Pain and source reliability
  • Map adversary behavior from a public advisory to MITRE ATT&CK tactics and techniques
  • Build an ATT&CK Navigator coverage layer that highlights detection gaps and priorities

Course Content

SOC104 · Threat Intelligence and the MITRE ATT&CK Framework (6 h)
Turn threat intelligence into defensive action by understanding intelligence types, indicators and the MITRE ATT&CK framework, then mapping your detection coverage and gaps.

  • Lesson 1 · What threat intelligence is and who uses it
  • Lesson 2 · Indicators, behaviors and the Pyramid of Pain
  • Lesson 3 · Using MITRE ATT&CK for defense
  • Lesson 4 · Lab and assignment
  • SOC104 Assessment · Threat Intelligence and the MITRE ATT&CK Framework
Scroll to Top