# Introduction to Cyber Threat Intelligence

> What cyber threat intelligence is, who consumes it, the four levels of intelligence, and the products analysts deliver.

Canonical: https://codelivly.com/rooms/cti-introduction-to-threat-intelligence
Last updated: 2026-10-28

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** This module establishes what cyber threat intelligence (CTI) is and what it is not. You will learn to separate data, information and intelligence, identify the people and teams who consume intelligence, and match each request to the right level of intelligence and the right product.

**Prerequisites.** Basic familiarity with how organisations defend networks (what a SOC, a firewall and an incident response team do). No prior intelligence experience is required.

**Measurable outcomes.** After this module you can:
- Define CTI and explain how it differs from raw threat data and from a threat feed.
- Name at least six CTI consumers and the decision each one uses intelligence for.
- Classify a request or product as strategic, operational, tactical or technical intelligence and justify the classification.
- Choose an appropriate product format and Traffic Light Protocol (TLP) marking for a given audience.

**Practical completion objective.** In the lab you triage ten synthetic intelligence requests for a fictional insurer, classifying each by intelligence level and consumer, and produce a short triage table you could hand to a CTI team lead.

## Lessons

1. What Cyber Threat Intelligence Is (and Is Not) (15 min)
2. Who Consumes Threat Intelligence and Why (15 min)
3. Strategic, Operational, Tactical and Technical Intelligence (20 min)
4. Intelligence Products, Formats and TLP (15 min)
5. Lab: Triage Intelligence Requests by Level and Consumer (40 min)

## Related

- [Learning path: Cyber Threat Intelligence Foundations](https://codelivly.com/learning-paths/cti-foundations)
- [All rooms](https://codelivly.com/rooms)