GIAC (SANS)GIAC Cyber Threat Intelligence
The GIAC Cyber Threat Intelligence (GCTI) certification validates a practitioner's strategic, operational, and tactical cyber threat intelligence knowledge and skills. GCTI holders are qualified to gather, analyze, and apply intelligence from vital sources, profile and analyze intrusions and malware, pivot and perform domain analysis, and create and share accurate and effective reports. This certification is for incident responders, threat hunters, SOC personnel, and analysts who need to deliver actionable intelligence that connects threat data across all layers of an organization.
386 practice questions · Updated 2026-07-30
GCTI Curriculum
Every domain, objective, and concept the GCTI exam measures.
- Intelligence Fundamentals Overview
- Intelligence Process Models
- Intelligence Requirements
- Intelligence Sources and Collection
- Intelligence Analysis and Production
- Intelligence Dissemination and Feedback
- Data Collection Planning
- Data Storage Architecture
- Data Normalization
- Data Retention Policies
- Data Security and Access Control
- Data Quality Management
- Data Integration and Enrichment
- Data Lifecycle Management
- Malware as a collection source
- Types of malware relevant to intelligence
- Malware analysis techniques
- Extracting intelligence from malware
- Legal and ethical considerations
- Intelligence Analysis Process
- Analytical Reasoning and Critical Thinking
- Intelligence Products and Reporting
- Threat Actor Profiling
- Indicators of Compromise (IOCs)
- Attribution and Confidence Levels
- Intelligence Sharing and Collaboration
- Ethical and Legal Considerations
- Intelligence Application Overview
- Intelligence Dissemination
- Intelligence Integration
- Intelligence-Driven Response
- Feedback and Iteration
- Kill Chain Overview
- Kill Chain Stages
- Kill Chain Application
- Diamond Model Overview
- Diamond Model Meta-Features
- Diamond Model Application
- Courses of Action Matrix Overview
- COA Categories
- COA Application
- Integration of Models
- Pivoting Fundamentals
- Pivot Types
- Pivot Data Sources
- Pivot Techniques
- Pivot Analysis
- Pivot Limitations
- Pivot Documentation
- Campaign Definition
- Campaign Lifecycle
- Campaign Attribution Challenges
- Attribution Methodologies
- Indicators of Compromise (IOCs)
- Threat Actor Profiling
- False Flag Operations
- Attribution Confidence Levels
- Intelligence sharing principles
- Sharing models and frameworks
- Information sharing standards and protocols
- Trust and collaboration in sharing
- Operationalizing shared intelligence
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for GCTI, so none is invented.