# Advanced Intelligence Analysis and Reporting

> Produce decision ready threat intelligence: risk based strategic analysis, competing hypotheses and bias control, intelligence driven detection, executive and technical reporting, and a full capstone investigation.

Canonical: https://codelivly.com/learning-paths/cti-advanced-analysis-reporting
Last updated: 2026-10-28

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Rooms | 5 |
| Lessons | 0 |

The final path of the Threat Intelligence Analyst career path. It takes you from analysing evidence to delivering judgements that change decisions and defences, and ends with a capstone investigation, Threat Intelligence Investigation and Reporting, in which you investigate a realistic fictional intrusion and produce the full set of intelligence products.

Prerequisites: the four earlier paths of this career path: CTI Foundations, OSINT and Indicator Analysis, Threat Actor Investigation, and CTI Operations and Sharing (or equivalent experience with the intelligence lifecycle, source evaluation, infrastructure pivoting, ATT&CK mapping and STIX 2.1).

Measurable outcomes. On completing this path you can:
- Write strategic assessments that connect threat, vulnerability, impact and likelihood to business decisions, and build indicators and warnings for alternative scenarios.
- Plan collection against intelligence gaps, apply Analysis of Competing Hypotheses with sensitivity analysis, run a key assumptions check, and mitigate common cognitive biases.
- Express judgements with ICD 203 likelihood terms and separately justified confidence.
- Turn reported TTPs into detection requirements, valid Sigma rules and simple YARA rules, measure coverage against ATT&CK v20 honestly, and prioritise defensive recommendations.
- Write a BLUF, key judgements, an executive briefing and a technical report with correct sourcing and TLP 2.0 marking, and actionable recommendations.
- Complete an end to end investigation: correlate evidence from logs, infrastructure and sources of differing reliability; reach a defensible conclusion at a stated confidence; and deliver executive, technical and STIX 2.1 products.

The path has five modules, each with a hands-on lab, and a final exam.

## Rooms in this path

1. [Strategic Intelligence and Risk Based Analysis](https://codelivly.com/rooms/cti-strategic-intelligence-and-risk) - Produce strategic intelligence that leadership can act on: assess threat, vulnerability, impact and likelihood, tie…
2. [Intelligence Gaps, Competing Hypotheses, and Analytical Bias](https://codelivly.com/rooms/cti-hypotheses-gaps-and-bias) - Plan collection against intelligence gaps, test explanations with Analysis of Competing Hypotheses and challenge…
3. [Intelligence Driven Detection and Defensive Recommendations](https://codelivly.com/rooms/cti-intelligence-driven-detection) - Turn adversary behaviour into detections and prioritised defensive actions: from TTPs to Sigma and YARA rules, coverage…
4. [Executive Briefings and Technical Intelligence Reports](https://codelivly.com/rooms/cti-briefings-and-reports) - Write intelligence products that get read and acted on: BLUF and key judgements, report structures for executives and…
5. [Final Threat Intelligence Investigation](https://codelivly.com/rooms/cti-final-investigation) - Capstone: Threat Intelligence Investigation and Reporting. Investigate a fictional intrusion end to end, weigh…

## Related

- [Career path: Threat Intelligence Analyst](https://codelivly.com/career-paths/threat-intelligence-analyst)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)
- [Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)