Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search exact control and technique identifiers, Cyber Wiki articles, framework records, playbooks, books, podcasts, Academy courses, individual lessons, and BMC Cyber Challenge activities.
GIAC GCTI Study Guide cover

Certification companion

GIAC GCTI Study Guide

Use the companion study guide to organize the material, compare important concepts, annotate key ideas, and build a written reference for review.

Bare Metal CyberGIAC learning path
View on AmazonOpen the related course

Certification names and marks belong to their respective owners. Bare Metal Cyber study resources are independent educational materials and do not imply endorsement.

Companion learning set

Use the resources together.

Move between the free audio course, structured reading, and active recall instead of treating each resource as a separate product.

Flashcards BookGIAC GCTI FlashcardsOpen companion →Free audio courseGIAC GCTIOpen Academy course →

Certification study plan

Use the audio course and companion books as one learning system.

Use the study guide to organize the course, annotate difficult concepts, and build a reference you can revisit.

Five-step cycle

  1. Plan the week

    Choose the lessons for the week, scan the matching book headings, and identify the concepts you expect to learn.

  2. Listen for structure

    Complete the assigned audio lessons and mark terms, examples, or decisions that need a second pass.

  3. Read for depth

    Use the study guide to clarify the lesson, annotate key ideas, and connect related objectives.

  4. Recall without prompts

    Use the flashcards or your own questions before looking at the answer. Separate strong topics from weak ones.

  5. Close the loop

    Open the linked Cyber Wiki articles, revisit missed lessons, and repeat difficult cards until you can explain the concept clearly.

The schedule is Bare Metal Cyber editorial guidance. Adjust the pace for your exam date, prior experience, and practice-test results.

Inside the book

Major subjects and chapter areas

What Cyber Threat Intelligence Is (and Is Not)Requirements, Intelligence Cycle, and Collection PlanningAnalysis Tradecraft, Bias, and Structured TechniquesAnalyst Tooling, Data Types, and CTI Operating EnvironmentApplying CTI to Real DecisionsCTI Use Cases and Stakeholder-Driven OutputsIntrusion Analysis as the CTI Core SkillFrom Single Intrusion to Campaign ThinkingCollection Sources and Data Set DesignDomains, DNS, and Infrastructure CluesTLS Certificates and Web Infrastructure SignalsInternal Sources: Logs, Alerts, and Case Data

Continue learning

Explore the related Cyber Wiki.

Direct and course-derived connections come from the existing Bare Metal Cyber catalog. Broader topic links are editorial recommendations, not publisher claims or official framework mappings.

Companion-course connection

Threat Intelligence Requirements

Threat intelligence requirements translate stakeholder decisions and uncertainties into specific questions that collection and analysis can answer.

Open article →Companion-course connection

Diamond Model of Intrusion Analysis

The Diamond Model examines relationships among adversary, capability, infrastructure, and victim while adding context such as time, direction, and confidence.

Open article →Companion-course connection

Malware Intelligence

Malware intelligence converts static features, runtime behavior, configuration, infrastructure, and family relationships into information defenders can use.

Open article →Companion-course connection

Passive DNS Analysis

Passive DNS analysis uses historical domain-to-address observations to examine infrastructure changes, relationships, reuse, and timing without directly querying adversary systems.

Open article →Companion-course connection

Executive Incident Briefings

Executive incident briefings summarize current impact, confidence, decisions, risks, resource needs, and next milestones without overwhelming leaders with raw technical detail.

Open article →Companion-course connection

Intelligence Handling Caveats

Intelligence handling caveats communicate restrictions, sensitivities, source protections, legal limits, and conditions that apply in addition to general sharing labels.

Open article →Companion-course connection

AI Audit Evidence Integrity

AI audit evidence integrity is the ability to show that logs, model artifacts, data extracts, test results, approvals, and screenshots are authentic, complete, attributable, and unchanged.

Open article →Companion-course connection

Data Dictionaries and Metadata

Data dictionaries and metadata describe fields, formats, meanings, allowed values, ownership, sensitivity, and relationships so data can be interpreted consistently.

Open article →Companion-course connection

Detection Tuning Feedback Loops

Detection tuning feedback loops use analyst dispositions, missed detections, environmental change, testing, and workload evidence to improve analytic precision without erasing useful coverage.

Open article →Companion-course connection

Detection Use-Case Acceptance Criteria

Detection use-case acceptance criteria define the threat behavior, data, logic, context, expected alert, performance, ownership, response path, and evidence required before a detection is treated as operational.

Open article →Companion-course connection

Executive Security Reporting

Executive security reporting gives decision makers a concise view of material exposure, control performance, incidents, obligations, trends, and choices requiring action.

Open article →Companion-course connection

Intelligence-Led Threat Hunting

Intelligence-led threat hunting converts validated adversary knowledge into hypotheses, data requirements, analytic methods, and searches for activity that existing detections may miss.

Open article →