Global Learning for Operational Leaders
Classroom
14 sessions
Scroll for more
Online / Live
14 sessions
Scroll for more
Introduction
Course overview
Threat intelligence helps organisations understand who is likely to attack them and how, while threat hunting proactively searches for attackers that have evaded automated defences.
This Aractech course covers the intelligence life cycle, sources and feeds, threat actor profiling, frameworks for attacker techniques, operationalising intelligence, hypothesis-driven hunting, hunt techniques and data sources, and measuring intelligence and hunting programmes. Participants plan and execute a simulated hunt.
The course suits security analysts and managers developing proactive capabilities.
What you will achieve
Learning objectives
- Explain the threat intelligence life cycle
- Use intelligence sources and frameworks
- Profile threat actors relevant to the organisation
- Operationalise intelligence in defences
- Plan and conduct threat hunts
- Measure intelligence and hunting value
Who should attend
Target audience
- Security analysts
- SOC staff
- Threat intelligence analysts
- Incident responders
- Security managers
- Risk professionals
Methodology
Learning approach
- Concept sessions
- Framework exercises
- Simulated hunt
- Case studies
- Group discussions
Complete course outline
Five focused days of learning and application
The timings provided are estimates and may vary depending on the number of participants and the discussions taking place during the sessions. They are indicative only and do not constitute a binding commitment.
Day 1
Threat Intelligence Fundamentals
- Intelligence types
- Life cycle
- Requirements
- Sources
- Coffee break
- Sources (continued)
- Sharing communities
- Exercise: Intelligence requirements
Day 2
Analysis and Frameworks
- Attacker technique frameworks
- Kill chain
- Indicators and behaviours
- Analytic methods
- Coffee break
- Analytic methods (continued)
- Bias
- Workshop: Mapping a campaign
Day 3
Operationalising Intelligence
- Detection engineering
- Blocking and enrichment
- Risk reporting
- Strategic intelligence
- Coffee break
- Strategic intelligence (continued)
- Case study: Intelligence-led defence
- Exercise: Intelligence report
Day 4
Threat Hunting
- Hunting approaches
- Hypotheses
- Data sources
- Techniques
- Coffee break
- Techniques (continued)
- Documentation
- Simulation: Threat hunt
Day 5
Programme Value
- Metrics
- Automation
- Team structure
- Coffee break
- Team structure (continued)
- Improvement
- Roadmap
- Capstone: Intelligence and hunting plan
FAQ
Frequently asked questions
What does Threat Intelligence and Threat Hunting (IMCS-018) cover?
This course covers IT Management and Cyber Security through a structured five-day outline focused on practical application, discussion, and implementation planning.
When is the next available session?
The next scheduled session starts on 16 - 20 November 2026. See the course schedules section for the available dates and delivery formats.
Who should attend this course?
Security analysts, SOC staff, Threat intelligence analysts
Is bilingual course delivery available?
Yes. All course materials and presentations are provided in English, while bilingual explanation and discussion support may be available depending on the selected location and trainer availability. For example, when attending a course in Istanbul, you may request a Turkish-speaking trainer to explain the English course content in Turkish. Arabic explanation support may also be requested at this location. Other languages are available in selected cities. You can choose your preferred language support as an optional preference during registration.
How can I register for a session?
Use any Register button next to the available course dates to open the participant registration page and submit your booking request for the selected session.
Is this course available online as well as classroom-based?
Check the course schedules section for currently published classroom and Online / Live sessions.
Where are classroom sessions delivered?
Current classroom venues include London, Istanbul, Cape Town, Barcelona, Rome, Munich, Amsterdam, Vienna.
How long is the training programme?
The programme runs for five days from 09:00 to 14:00, which gives 25 contact hours, including a daily 30-minute break (22.5 hours of instruction).
Quick request
Send quick request
Send a fast enquiry about this course and the academy team will get back to you.
Get a quotation
Request a formal quotation
Choose an available date and venue, add your participants, and we will email a formal quotation for Threat Intelligence and Threat Hunting to your business address.