# Final Threat Intelligence Investigation

> Capstone: Threat Intelligence Investigation and Reporting. Investigate a fictional intrusion end to end, weigh competing explanations, and deliver executive, technical and machine readable intelligence products.

Canonical: https://codelivly.com/rooms/cti-final-investigation
Last updated: 2026-10-28

| | |
|---|---|
| Level | Advanced |
| Category | Cybersecurity |
| Lessons | 6 |
| XP | 250 |

Purpose: the capstone of the Threat Intelligence Analyst career path, titled Threat Intelligence Investigation and Reporting. You receive a complete, fictional investigation package from a logistics company (alerts, email, proxy, identity, VPN and file server logs, passive DNS, WHOIS, certificate and scan data, and intelligence reports from sources of differing reliability) and must work out what happened, who is most likely responsible and why, how confident you can be, and what the organisation should do.

Prerequisites: all four earlier paths of the Threat Intelligence Analyst career path and modules 1 to 4 of this path.

Measurable outcomes. After this module you can:
- Correlate alerts, logs, infrastructure and source reporting into a single evidence base with source assessments.
- Evaluate at least three competing hypotheses with ACH and reach a defensible conclusion at a stated confidence.
- Build a campaign timeline that separates confirmed, inferred and unknown events.
- Map behaviour to MITRE ATT&CK (v20) only where the evidence justifies it.
- Produce an executive summary, a technical report, prioritised defensive recommendations, unresolved intelligence requirements and a valid STIX 2.1 bundle containing only shareable indicators.

Practical completion objective: pass the graded analysis checkpoints (answers derived from the package) and submit all nine written deliverables, self assessed against the published rubric, which rewards evidence based, well sourced reasoning and honest uncertainty rather than one assumed attribution.

## Lessons

1. Capstone Briefing: Scope, Rules and Deliverables (15 min)
2. The Investigation Package (1 h)
3. Guided Analysis Checkpoints (1 h)
4. Deliverables Part 1: Evidence, Timeline, ATT&CK Mapping and Confidence (1 h 15 min)
5. Deliverables Part 2: Executive Summary, Technical Report, Recommendations and STIX Sharing (1 h 30 min)
6. Debrief and Instructor Reference Solution (20 min)

## Related

- [Learning path: Advanced Intelligence Analysis and Reporting](https://codelivly.com/learning-paths/cti-advanced-analysis-reporting)
- [All rooms](https://codelivly.com/rooms)