C|TIA Training – Certified Threat Intelligence Analyst
C|TIA teaches you to build a threat intelligence programme that actually serves the business: defining requirements, collecting and processing data, analysing it and then publishing reports that SOC, incident response and leadership teams can act on. The course is built around 27 hands-on labs and runs live online, in person in Casablanca or on-site at your organization, in French or English.
Tell strategic, operational, tactical and technical intelligence apart
Use attack frameworks to model threats
Define intelligence requirements and plan a programme
Collect and process data from open, commercial and internal sources
Analyse data and produce sound assessments
Write and share reports tailored to each audience
Feed intelligence into SOC work, incident response and risk management
Program
Introduction to threat intelligence
Intelligence types and lifecycle
Cyber threats and attack frameworks
Threat actors, motives and attack models
Requirements, planning, direction and review
Priority requirements, stakeholders, roadmap
Data collection and processing
OSINT, feeds, human and internal sources
Normalisation and enrichment
Data analysis
Analytic methods and bias reduction
Intelligence reporting and dissemination
Report formats and information sharing
Threat hunting and detection
Hunting hypotheses and automation
Threat intelligence in SOC operations, incident response and risk management
Operational integration and measuring value
Prerequisites
At least three years of cybersecurity experience, or
EC-Council CEH and CND certifications
Good understanding of common attacks and security logs
Target audience
Threat intelligence analysts and experienced SOC analysts
Incident response team members
Threat hunters and detection engineers
Security managers who run a CTI programme
Cyber risk management professionals who need evidence-based threat assessments
The exam
The C|TIA exam (312-85) has 50 multiple-choice questions to answer in 2 hours, with a pass mark of 70%. It is delivered through EC-Council's exam centres (ECC Exam Centers). Questions span the whole intelligence lifecycle, from setting requirements through to dissemination and use. Renewal conditions are set by EC-Council, and we walk you through them when you enrol.
Preparation tips
Link each step of the intelligence lifecycle to a concrete deliverable
Practise mapping a public attack report onto a framework such as MITRE ATT&CK
With 50 questions in 2 hours, take time to reread each question
Frequently asked questions (FAQ)
What is cyber threat intelligence (CTI)?
It is information about adversaries, their tools, their infrastructure and their targets, collected and analysed so that an organisation can prioritise risks and make better, faster defensive decisions.
Do I need CEH and CND before C|TIA?
No, they are one option. Three years of cybersecurity experience also qualifies you. The two certifications do, however, give you a very useful base for keeping up with the course.
Is the exam difficult?
It is short, with 50 questions in 2 hours, but it rewards a real grasp of intelligence methodology rather than memorised definitions. A 70% pass mark leaves little room for error, so review every stage of the lifecycle carefully.
Is C|TIA useful for a SOC analyst?
Yes. A full module covers how intelligence feeds SOC operations, incident response and risk management. It is a natural next step after Certified SOC Analyst.
Is there hands-on work?
Yes. The course includes 27 labs on real networks and platforms, covering data collection, threat modelling, analysis and automating threat hunts.