
Threat Intelligence Analyst — career path
StationX Advanced
Know the adversary before they arrive. Security+ and CySA+ for the SOC grounding every CTI advert expects, then open-source intelligence tradecraft, the CTI models and frameworks, and Python to enrich the data.
6 courses · 83 sections · 403 lectures · 6 labs · ≈ 5 h of hands-on labs
Free to start: the free lessons and guides for this roadmap →
Try a free SOC lab: Shut the door (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Security foundation
The baseline virtually every CTI job spec requires.
follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
Learn

- PathFollow the CompTIA Security+ (SY0-701) path — the entry certification for every intelligence role
11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
9 steps — The industry-standard entry certification for a cyber security role.
Step 2 — SOC grounding, certified
CTI teams hire from the SOC: alerts, SIEM and incident response first.
follows the whole CompTIA CySA+ (CS0-004) roadmap: 5 courses · 35 sections · 188 lectures · 169 labs · ≈ 181 h of hands-on labs
Learn

- PathFollow the CompTIA CySA+ (CS0-004) path — the threat-intelligence and detection labs live on this path
5 courses · 35 sections · 188 lectures · 169 labs · ≈ 181 h of hands-on labs
6 steps — The blue-team analyst certification and the natural step after Security+. Security operations, vulnerability management, incident response and reporting.
Step 3 — OSINT tradecraft
Find, verify and pivot on open sources without tipping anyone off.
3 courses · 61 sections · 282 lectures
Learn
- CourseOSINT: Open-Source Intelligence (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
21 sections · 140 lectures
- Training Overview 2
- Introduction 10
- Reporting 2
- Getting started 5
- About sock puppets 6
- Data collection 5
- Advance searching 8
- Reverse searches 7
- Employee and employer searches 1
- People searches 11
- Website OSINT 7
- The Darkweb 6
- Various browser plugins 5
- Social media 14
- OSINT Frameworks 1
- Miscellaneous 9
- Bringing it all together 14
- Additional content 8
- Bonus 6
- Additional Content 12
- Audio Version of Training 1
- CourseOSINT: Open-Source Intelligence Level 2 (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
32 sections · 106 lectures
- Training Overview 1
- Introduction 3
- Setting up our virtual machine with Virtualbox 1
- Checklist 2
- Website crawling tools 7
- Social Engineering 4
- Home ownership 2
- Encryption 4
- Canary Tokens 2
- Nmap/Zenmap 1
- Checking usernames 2
- Search code 2
- VPN 2
- Criminal checks 5
- Additional Twitter tools 5
- Additional Facebook tools 2
- Reddit 1
- Instagram 3
- Plagiarism Check 1
- Sock puppets 3
- Dating 5
- Other people search 8
- Politics 4
- Business 7
- Bitcoin 2
- Vehicle 5
- Darkweb 7
- Images 5
- Investigation 3
- Identifying and dealing with misinformation 2
- In closing and bonuses 4
- Audio Version of Training 1
- CourseThe Secrets of OSINT (Open-source Intelligence) (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
8 sections · 36 lectures
- Training Overview 2
- Introduction 2
- Section 1. Going undercover 4
- Section 2. Recruiting Intelligence Sources 8
- Section 3. How to Make Search Engines Talk 5
- Section 4. How to Interrogate Social Networks 8
- Section 5. Loading Heavy Guns 6
- Audio Version of Training 1
Step 4 — Cyber threat intelligence core
The Kill Chain, the Diamond Model and ATT&CK — the intelligence labs are on the CySA+ step. STIX/TAXII and platforms such as MISP are learned on the job; no course for them is sold here.
2 courses · 17 sections · 103 lectures
Learn
- CourseCyber Threat Intelligence - Basics & Fundamentals (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 68 lectures
- Training Overview 2
- Introduction 4
- Definitions & Fundamentals 15
- Cyber Threat Intelligence Objectives 6
- CTI Specific Models 15
- CTI Reports - Examples 3
- Use case 1 - Ransomware group Primo-Analysis 8
- Use Case 2 - Darkweb Monitoring 8
- Use Case 3 - Adversary Controlled Infrastructure Hunting 5
- Conclusion 1
- Audio Version of the Training 1
- CourseMITRE ATT&CK Framework Essentials (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
6 sections · 35 lectures
- Training Overview 2
- Section 1: Introduction 9
- Section 2: Tactics, Techniques, and Procedures (TTP's) 12
- Section 3: Other Learning Resources 4
- Section 4: Update - Adversarial Threat Landscape for AI Systems 7
- Audio Version of Training 1
Step 5 — Script the enrichment
Pull, parse and enrich indicators in Python instead of by hand.
1 course · 5 sections · 18 lectures · 6 labs
Learn
- CourseTOTAL: Introduction to Python (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
5 sections · 18 lectures
- Training Overview 2
- Chapter 1: Welcome to Python! 6
- Introduction to Programming 5
- Data Processing with Python 4
- Audio 1
Practise
- Infra LabsIntroductory Python — 6 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Manipulate Strings in PythonLevel: GuidedDuration: 1 h
- Manage the Flow of Execution by Using Loops in PythonLevel: GuidedDuration: 30 min
- Create Branching Logic in PythonLevel: GuidedDuration: 45 min
- Define and Use Functions in PythonLevel: GuidedDuration: 45 min
- Store Data in Python Data StructuresLevel: GuidedDuration: 1 h
- Handle Errors and Exceptions in PythonLevel: GuidedDuration: 45 min
Where this leads
Choose your next roadmap
Advanced · after the job
The AI-Driven Threat Intelligence Analyst
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.

