# Threat Intelligence Operations and Sharing

> Structure, exchange, curate and disseminate threat intelligence with STIX 2.1, TAXII 2.1, MISP and OpenCTI, and make it change SOC and IR outcomes.

Canonical: https://codelivly.com/learning-paths/cti-operations-and-sharing
Last updated: 2026-10-28

| | |
|---|---|
| Level | Intermediate |
| Category | Cybersecurity |
| Rooms | 5 |
| Lessons | 0 |

This learning path covers the operational side of cyber threat intelligence: how intelligence is structured, exchanged, curated, handled and put to work. It moves from intermediate standards work (STIX 2.1, TAXII 2.1, MISP and OpenCTI) to advanced integration with SOC and incident response teams.

**Prerequisites.** Learning Paths 1 to 3 of the Threat Intelligence Analyst career path, or equivalent: the intelligence lifecycle, confidence and estimative language, indicator analysis and pivoting, ATT&CK mapping, and actor and campaign tracking. Comfort reading JSON and basic HTTP.

**On completion you will be able to:**
- read, write and validate STIX 2.1 objects, relationships, sightings and patterns, and apply TLP 2.0 markings with the correct marking-definition ids
- specify and troubleshoot TAXII 2.1 integrations: discovery, collections, filtering, pagination, submissions and status
- model, curate and share data in MISP and OpenCTI with correct distribution, sharing groups and handling
- run requirements, prioritise work, and tailor and disseminate products to executive, operational and technical audiences with feedback
- turn intelligence into enrichment, IOC dispositions, detection requirements, hunting hypotheses and incident support, measured by outcomes

**How it is assessed.** Each module ends with a hands-on lab built on synthetic datasets (STIX bundle analysis, a simulated TAXII exchange, MISP event triage, a dissemination plan and a detection engineering handoff), followed by a path exam.

## Rooms in this path

1. [STIX 2.1 and Structured Intelligence Objects](https://codelivly.com/rooms/cti-stix-2-1-objects) - Read, write and validate STIX 2.1 objects, relationships, sightings, patterns and TLP markings.
2. [TAXII 2.1 and Intelligence Exchange Concepts](https://codelivly.com/rooms/cti-taxii-2-1-exchange) - Understand sharing models and operate TAXII 2.1 discovery, collections, paging and submissions correctly.
3. [MISP and OpenCTI Workflows](https://codelivly.com/rooms/cti-misp-and-opencti-workflows) - Model, curate and share intelligence in MISP and OpenCTI without leaking data or flooding consumers with noise.
4. [Intelligence Requirements, Prioritization, and Dissemination](https://codelivly.com/rooms/cti-requirements-prioritization-dissemination) - Run requirements, prioritise work, tailor products to audiences and disseminate them with correct handling and real…
5. [Integrating CTI into SOC and Incident Response Workflows](https://codelivly.com/rooms/cti-soc-and-ir-integration) - Make intelligence change SOC and IR outcomes: enrichment, IOC lifecycle, detection handoffs, hunting, incident support…

## Related

- [Career path: Threat Intelligence Analyst](https://codelivly.com/career-paths/threat-intelligence-analyst)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)
- [Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)