Introduction to Threat Intelligence and Attribution

August 30–31, 2021 (Americas / EMEA evening)


This course is a fast-paced introduction to threat intelligence and attribution. It is designed to provide insight into attribution methodology and demonstrate the proper handling of threat intelligence information.

The course explores the main components of a threat group and shows how FireEye analysts use raw tactical intelligence and weigh connections and relationships to build a set of related activities that corresponds to a group of threat actors. Learners will become familiar with several factors they should consider when attributing related activity, and view real-world examples of research and pivoting. The course also examines operational and strategic intelligence, which helps determine the “who” and the “why” behind an attack.

The course also clarifies critical security terminology so learners can separate valuable information from hype. 

Please Note: This course overlaps with content in the Cyber Intelligence Foundations course. We recommend taking this course or Cyber Intelligence Foundations, not both.

Event Information

  • LOCATION: Online
  • START DATE: August 30, 2021 
  • END DATE: August 31, 2021 
  • TIME: 8:00am–12:30pm Pacific Daylight Time, daily
    • UTC 15:00-19:30
    • 11:00am–3:00pm EDT
    • 4:00pm–8:30pm BST
  • COST: US$2,000 or 2 EOD units

Expertise On Demand (EOD) units will be accepted

Learning Objectives

After completing this course, learners should be able to:

  • Understand various definitions of threat intelligence and attribution
  • Distinguish between tactical, operational and strategic threat intelligence
  • Use tactical intelligence in the early stages of a cyber attack to evaluate data and correctly identify indicators that can be grouped into a set of related activity and attributed to a threat group
  • Gain insight into common errors that can occur when analyzing common forensic artifacts and interpreting information presented from various sources
  • Examine operational and strategic intelligence to determine the attribution and sponsorship of an attack operation
  • Understand how attribution analysis can provide crucial context to threat activity that enables more informed decisions and improved resource allocation
  • Understand why attributing cyber operations to a threat group can have significant implications — and even affect geopolitical dynamics
  • Consider attribution from a threat group’s point of view 

Who Should Take This Course

Cyber intelligence analysts, cyber threat analysts, security analysts and penetration testers. 


A working understanding of basic information security principles. A general understanding of threat intelligence and indicators of compromise (IoCs). Experience conducting forensic analysis, network traffic analysis, log analysis, security assessments and penetration testing, security architecture and system administration duties are a plus, but not required. 

Technical Requirements

Students will access the live instructor-led course online. Students will require a computer that meets the following minimum requirements:

  • Internet Connection: 25 Mbps+ recommended
  • Browser: Chrome recommended
  • Operating System: Windows or MacOS

Course Materials

Students will receive access to all required class materials.

Have questions?

If you have any additional questions, send us an email.

Thank you.