# Cyber Threat Intelligence Foundations

> The core of threat intelligence work: requirements, the intelligence lifecycle, threat actors, sources and collection, and disciplined analytic reasoning.

Canonical: https://codelivly.com/learning-paths/cti-foundations
Last updated: 2026-10-28

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Rooms | 5 |
| Lessons | 0 |

This learning path builds the foundation every threat intelligence analyst needs before working with indicators, actor investigations or sharing platforms. You will learn what cyber threat intelligence (CTI) is for and who uses it, how to turn stakeholder concerns into intelligence requirements, how threat actors differ in motivation and capability, where intelligence comes from and how to grade it, and how to reason from evidence to an assessment with clear likelihood and confidence.

**Learning outcomes.** On completing this path you will be able to:
- Explain the purpose of CTI and match intelligence to its consumers, and classify any request or product as strategic, operational, tactical or technical.
- Describe the six phases of the intelligence lifecycle and write priority intelligence requirements (PIRs) and supporting intelligence requirements from stakeholder interviews.
- Categorise threat actors and rate their capability and intent towards an organisation from supplied reporting, citing the evidence for each rating.
- Compare source types (OSINT, internal telemetry, commercial feeds, ISACs, closed sources, human reporting), apply legal and ethical limits to collection, and assign Admiralty (NATO) ratings for source reliability and information credibility.
- Separate fact, inference, hypothesis and assessment; use the ICD 203 estimative scale and high, moderate or low confidence correctly; and recognise common cognitive biases.
- Apply TLP 2.0 markings correctly when producing and sharing intelligence.

**How you will practise.** Each of the five modules ends with a browser-based lab using synthetic, internally consistent datasets: triaging intelligence requests, writing PIRs from interview notes, profiling fictional actors, building a source evaluation matrix, and reviewing a draft report for fact, inference and assessment. The path closes with a 24-question exam.

**Prerequisites.** General familiarity with how organisations defend networks. No prior intelligence experience is needed.

## Rooms in this path

1. [Introduction to Cyber Threat Intelligence](https://codelivly.com/rooms/cti-introduction-to-threat-intelligence) - What cyber threat intelligence is, who consumes it, the four levels of intelligence, and the products analysts deliver.
2. [Intelligence Lifecycle and Requirements](https://codelivly.com/rooms/cti-intelligence-lifecycle-and-requirements) - Run the intelligence lifecycle and turn stakeholder concerns into prioritised intelligence requirements and PIRs.
3. [Threat Actors, Motivations, and Objectives](https://codelivly.com/rooms/cti-threat-actors-and-motivations) - Categorise threat actors, reason about their motivations and objectives, and assess capability, intent and opportunity.
4. [Intelligence Sources and Collection Methods](https://codelivly.com/rooms/cti-sources-and-collection) - Know the source types CTI teams use, collect within legal and ethical limits, and grade sources with the Admiralty…
5. [Analytical Reasoning, Evidence, and Confidence](https://codelivly.com/rooms/cti-analytical-reasoning-and-confidence) - Separate evidence from inference and judgement, express likelihood and confidence precisely, and recognise common…

## Related

- [Career path: Threat Intelligence Analyst](https://codelivly.com/career-paths/threat-intelligence-analyst)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)
- [Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)