Cyber Threat Intelligence Bootcamp: Hands-on Labs & Real-World Scenarios
Training Overview
Cyber Threat Intelligence Bootcamp: Hands-on Labs & Real-World Scenarios is a three-day, immersive training at CSA XCON 2026, designed to transform raw threat data into actionable intelligence that security teams can operationalize.
Cyber Threat Intelligence (CTI) is no longer just about collecting IOCs it’s about understanding adversaries, automating intelligence pipelines, enabling proactive threat hunting, and supporting business-driven security decisions. This bootcamp takes participants from CTI fundamentals to real-world operational deployment inside SOC, SIEM, and EDR workflows.
The training blends hands-on labs, Python-based automation, real threat datasets, malware samples, and real-world adversary case studies.
About the Training at CSA XCON 2026
This training focuses on practical CTI operations, not theory-heavy lectures.
Key highlights include:
- Intelligence lifecycle & CTI frameworks
- OSINT collection and pivoting techniques
- Python automation for threat intelligence
- Malware and darknet intelligence basics
- Threat hunting using YARA, Sigma, and PCAPs
- Operationalizing CTI inside SOC environments
Participants will leave with repeatable CTI workflows they can immediately apply in real organizations.
What You Will Learn
1 – Cyber Threat Intelligence Foundations
CTI Fundamentals
- What is Cyber Threat Intelligence (CTI)?
- Intelligence lifecycle & CTI types: Strategic, Operational, Tactical & Technical
- Cyber Kill Chain, MITRE ATT&CK, Diamond Model
- How CTI supports SOC, IR, and risk teams
- Real-world CTI case studies
Python Refresher
- Python data types, loops, and conditionals
- Functions and file handling
- Parsing structured data: JSON, XML, CSV & STIX / TAXII
- Virtual environments and modules
OSINT for Threat Intelligence
- OSINT concepts and collection techniques
- Indicators of Compromise (IOCs)
- OSINT tools and intelligence feeds
- Hands-on OSINT analysis & correlation
- Pivoting across: Social media, Domain records, Breach databases & Public threat feeds
2 – Automating Threat Intelligence & Analysis
Threat Intelligence Automation
- Automating OSINT collection with Python
- Parsing and enriching threat feeds
- Correlating multiple intelligence sources
- Hands-on Python scripting labs
- Alerting and notification automation
- TAXII feeds for intelligence sharing
- Honeypots for CTI data collection
Malware & Darknet Intelligence
- Malware intelligence collection techniques
- Static and dynamic malware analysis basics
- File classification & hashing
- Extracting IOCs from malware samples
- Darknet intelligence sources: Marketplaces, Forums & Cybercrime ecosystems
- OPSEC considerations
- Hands-on adversary analysis from leaked data
3 – Operationalizing CTI
Threat Hunting with CTI
- Threat hunting fundamentals
- Using CTI for proactive defense
- PCAP analysis and traffic inspection
- Correlating internal logs with external intelligence
- Hands-on YARA rule creation
- Hands-on Sigma rule development
- CTI-driven detection strategies
Operational CTI & Program Building
- Intelligence requirement gathering
- Tracking emerging threats
- Mapping TTPs to MITRE ATT&CK
- Showcasing intelligence findings
- Integrating CTI into: SIEM, EDR & SOC workflows
- Stakeholder engagement & intelligence sharing
- Metrics for measuring CTI effectiveness
- Building and scaling a CTI program
Training Experience & Expectations
- Highly hands-on with real datasets
- Python-driven automation throughout
- Realistic CTI workflows used in SOCs
- Focus on decision-ready intelligence
Participants leave with practical CTI capabilities, not just theoretical understanding.
Who Should Attend
This training is ideal for:
- SOC analysts & blue team members
- Threat intelligence analysts
- Incident responders
- DFIR professionals
- Security engineers
- Anyone responsible for operationalizing CTI
Skill Level
Beginner to Intermediate
Participant Requirements
Participants should bring:
- Laptop (Windows, macOS, or Linux)
- Minimum 8GB RAM & 50GB free disk space
- Virtualization software (VMware / VirtualBox)
- Python 3.x & Jupyter Notebook
- Admin/root access
What Participants Will Receive
Each participant will receive:
- Training slide decks
- CTI resources & reference material
- Hands-on labs and datasets
- Automation scripts and examples
What This Training Is
What to expect:
- Real-world CTI workflows
- Automation-first mindset
- SOC-ready intelligence practices
What not to expect:
- Pure theory lectures
- Offensive pentesting or exploit development
- Deep reverse engineering