NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Final Threat Intelligence Investigation
Capstone: Threat Intelligence Investigation and Reporting. Investigate a fictional intrusion end to end, weigh competing explanations, and deliver executive, technical and machine readable intelligence products.
Room tasks
1Capstone Briefing: Scope, Rules and Deliverables
2The Investigation Package
3Guided Analysis Checkpoints
4Deliverables Part 1: Evidence, Timeline, ATT&CK Mapping and Confidence
5Deliverables Part 2: Executive Summary, Technical Report, Recommendations and STIX Sharing
6Debrief and Instructor Reference Solution
Frequently Asked Questions
What does a threat intelligence investigation involve?
It involves collecting evidence about an intrusion, analyzing indicators and adversary behavior, testing hypotheses and reporting judgments with stated confidence so defenders can act on the findings.
What should a CTI investigation report contain?
A clear bottom line, key judgments with confidence levels, supporting evidence, a timeline, indicators and defensive recommendations. It should separate facts from assessment and suit its audience.
Can I practice a full CTI investigation for free?
Yes. This advanced capstone room on Codelivly is free and hands-on. You investigate a fictional intrusion from evidence to final report, applying everything from the threat intelligence track.