The tools will change.The way you think shouldn’t.

Hands-on threat intelligence training for people who want to understand the why, not just the how.

Tools change. What endures is the ability to reason through uncertainty, connect evidence, challenge assumptions, and understand what the data can—and cannot—tell you.

My workshops use real investigative problems and modern tools to teach the thinking that carries from one investigation to the next.

Explore the workshops

Five sessions from the first course

Read the five sessions as text

The steps and the two counts, 36 and 8,065, are the course’s own. The IP addresses are RFC 5737 documentation addresses, and the certificate’s name and the second search’s terms are stand-ins, because the case is TLP:RED (Traffic Light Protocol: for the people in the room only). Line and token counts are illustrative.

Part 3: Investigate

  1. Prompt: Compare 192.0.2.146 and 198.51.100.84 using live Team Cymru Scout data. What role does each seem to play, and what should we inspect next?
  2. Tool call: scout - get_ip_foundation (MCP)(ips: ["192.0.2.146", "198.51.100.84"])
  3. Result: { "ip": "192.0.2.146", "tags": ["controller"] } { "ip": "198.51.100.84", "tags": ["scanner"] }
  4. Tool call: scout - search (MCP)(query: "x509.subject.cn=\"Larkspur Relay\"")
  5. Result: { "total": 36 }
  6. Tool call: scout - search (MCP)(query: "x509.subject.o=\"Larkspur\" x509.selfsigned=\"true\"")
  7. Result: { "total": 8065 }
  8. Claude: 192.0.2.146 is tagged controller. 198.51.100.84 is a scanner, so it drops out. The certificate it serves turns up on 36 hosts. Searching on its organisation alone returns 8,065, too broad to carry forward. Next: the 36.

Part 4: Prove it

  1. Prompt: Search the same pivot again. For every claim apply exactly one label: [OBSERVED] with the tool and field that returned it, or [INFERRED] with what it rests on and your confidence.
  2. Tool call: scout - search (MCP)(query: "x509.subject.cn=\"Larkspur Relay\"")
  3. Result: { "total": 36 }
  4. Claude: [OBSERVED] 36 hosts serve the same certificate subject. Source: search, total. [INFERRED] Same tool family, not the same operator: that subject is the tool’s default. Confidence: medium.
  5. Prompt: Write output/01-investigation/report.md and findings.json to that standard. Include an address only if an [OBSERVED] claim supports it.
  6. Tool call: Write(output/01-investigation/findings.json)
  7. Result: Wrote 112 lines to output/01-investigation/findings.json
  8. Tool call: Write(output/01-investigation/report.md)
  9. Result: Wrote 64 lines to output/01-investigation/report.md
  10. Claude: Both files are written. Every address in findings.json has at least one [OBSERVED] claim behind it.

Part 5: Own your tooling

  1. Prompt: Convert output/02-prd/playbook.md into .claude/skills/investigation-playbook/SKILL.md. Keep my judgement calls. Then test it: describe a new suspicious IP without naming the skill, and tell me whether it loaded and why.
  2. Tool call: Read(output/02-prd/playbook.md)
  3. Result: Read 86 lines
  4. Tool call: Write(.claude/skills/investigation-playbook/SKILL.md)
  5. Result: Wrote 58 lines to .claude/skills/investigation-playbook/SKILL.md --- name: investigation-playbook description: Investigate suspicious infrastructure with Team Cymru Scout. Rank pivots by signal; label every claim observed or inferred. ---
  6. Tool call: Skill(investigation-playbook)
  7. Result: Successfully loaded skill
  8. Claude: It loaded on the case description alone: the description matched “suspicious IP” and “what does it talk to”. Two steps to cut before you rely on it: one is specific to this case, and one spends a Scout call for little return.

Part 6: Build the team

  1. Prompt: Write the reviewer role for .claude/skills/threat-report/SKILL.md. It receives only the investigator’s claims and their cited sources, never its reasoning. Its instruction is to refute each claim, and to default to rejected when the evidence is ambiguous.
  2. Tool call: Read(.claude/skills/threat-report/SKILL.md)
  3. Result: Read 34 lines
  4. Tool call: Update(.claude/skills/threat-report/SKILL.md)
  5. Result: Added 8 lines ## Reviewer Input: claims.json and its cited sources. Nothing else. Refute each claim. Do not verify it. Default to rejected when the evidence is ambiguous. Look hardest at claims that say more than their source. ## When the two disagree Up to two review cycles. Then record the disagreement.
  6. Claude: The reviewer runs as a subagent whose only input is claims.json. It never sees how the investigator got there, so it has no stake in the answer.

Part 7: Run the team

  1. Prompt: Run the threat-report skill on our case, inside its research boundary. Show me the handoff: what the investigator claimed, what the reviewer challenged, and what survived.
  2. Tool call: Skill(threat-report)
  3. Result: Successfully loaded skill
  4. Tool call: Task(Investigator: gather claims from the case file)
  5. Result: Done (7 tool uses · 18.2k tokens · 41s)
  6. Tool call: Task(Reviewer: refute claims.json)
  7. Result: Done (3 tool uses · 9.6k tokens · 24s)
  8. Claude: Investigator: 12 claims. Reviewer: 9 stand, 2 downgraded to [INFERRED], 1 rejected. Rejected: “same operator”. The certificate shows a tool family. Nothing returned says who runs it.
  9. Tool call: Write(output/03-report/threat-report.md)
  10. Result: Wrote 96 lines to output/03-report/threat-report.md
  11. Claude: The report carries the nine, the two downgrades and the one disagreement, each traceable to its source.

Courses

Threat Intelligence with Claude Code and Team Cymru Scout

. Four hours on one live case. Level 1 of 3, Foundational. 4 hours. Hands-on workshop. Syllabus

Threat Intelligence with Claude Code and Team Cymru Scout is a four-hour hands-on workshop on one live case, worked in a TLP:RED room. I lead it. It can run as a full day: a four-hour hackathon follows, where people apply what they just learned to something of their own.

Who it’s for
Threat-intelligence analysts and investigators. You don’t need to have used Claude Code before
Before you come
A laptop with Git and a terminal. You run one pre-flight script before the day. Claude Code and Team Cymru Scout access are issued for the session
Tools
  • Claude Code
  • Team Cymru Scout MCP

The four hours

  1. Before the day: Pre-flight
    , Before you arrive

    One script checks your terminal, Claude Code, the Team Cymru Scout API and MCP tools, so the room starts on the case.

  2. How Claude thinks
    , 15 min

    The context window, what happens as it fills, and why plan mode, focused tasks, supervision and fresh sessions all follow from it.

  3. Orientation
    , 20 min

    The case brief and its two reported addresses. Two ways into Team Cymru Scout: its Model Context Protocol (MCP) server for investigating, the REST API for building.

  4. Investigate
    , 30 min

    Compare the two addresses on live data, pull the stronger lead apart, interrupt a run that drifts, and rank each pivot as high-signal, noisy or a dead end.

  5. Prove it
    , 30 min

    Audit the output for claims the data never returned. Re-run it with every claim labelled observed or inferred, then save a case file another analyst can check.

  6. Own your tooling
    , 30 min

    Write your method down as a playbook, package it as a skill Claude loads on the next case, and test that it triggers without being named.

  7. Build the team
    , 35 min

    Set a research boundary, then write two roles: an investigator that only gathers and a reviewer whose only job is to refute.

  8. Run the team
    , 25 min

    Run the cycle on your own case, write the threat report from what survived review, and read what the reviewer rejected.

  9. Optional: Hackathon
    , Optional · 4 hours

    Teams of three to five take what they built in the workshop and apply it to an idea of their own, with me still in the room. Three hours to build, one to show the room.

You leave with

  • A case file with every claim labelled observed or inferred
  • An investigation skill that loads on your next case
  • An investigator and reviewer agent team that writes the report
  • Five follow-up modules for the first week back
Ask about this course

Agentic CTI

. From one investigation to a pipeline that runs every day. Level 2 of 3, Intermediate. Full day. Hands-on course. Syllabus

Agentic CTI (cyber threat intelligence) is a full-day hands-on course for teams who already investigate by hand. You build the pipeline that does the first pass: intake, enrichment, infrastructure mapping, triage and detection rules, on your own data sources next to Team Cymru Scout.

Who it’s for
Threat-intelligence teams already doing investigations by hand
Before you come
Working threat-intel experience. Some scripting helps
Tools
  • Claude Code
  • MCP

Modules

  1. From one case to a pipeline

    What changes when an investigation has to run every day without you starting it.

  2. Live telemetry through MCP

    Connect your own data sources next to Team Cymru Scout as MCP servers, and decide which path feeds the agent and which feeds code.

  3. IOC intake and enrichment

    Deduplicate a messy feed, enrich it across sources, and score each indicator with a sourcing chain an analyst can audit.

  4. Mapping adversary infrastructure

    Expand a seed set through certificates, fingerprints and peers, and rank every pivot by how specific the link is.

  5. Timelines you can defend

    Rebuild when infrastructure appeared and changed, then package it as STIX with every timestamp tied to a tool result.

  6. Triage with a reviewer in the loop

    First-pass triage run by an investigator and a reviewer agent, with a person making the final call.

  7. From finding to detection

    Turn what the pipeline found into Sigma and YARA rules, and test them against baseline data.

You leave with

  • An enrichment pipeline whose scores you can trace to a source
  • An infrastructure-mapping workflow on your own telemetry
  • A triage loop with a reviewer agent and a human sign-off
  • Detection rules generated from a case and tested
Ask about this course

How rooms scored the Threat Intelligence course

Instructors and mentors:
93%.
39 of 42 respondents across both sessions picked the instructors and mentors as something that worked well.
Net Promoter Score:
72.
In Strasbourg, 23 of 29 respondents scored 9 or 10 out of 10 on recommending it: a Net Promoter Score of 72.
Poor ratings:
0.
None of the 47 respondents, across both sessions, rated any section of the course Poor.

From the anonymous surveys, in their own words

“The most useful session I’ve attended in a long time.”

Workshop attendee, RISE Ireland, Dublin, April 2026

“I wish there was a rank above excellent. Been in tech for decades and in countless sessions like this, and by far this is clearly the best I have ever experienced.”

Workshop attendee, The Underground Economy Conference, Strasbourg, September 2026

  • “The way investigations are conducted becomes simpler once you learn about skills and agents.”

    Workshop attendee, The Underground Economy Conference, Strasbourg, September 2026

  • “Instructor was very clear and well organized. I personally appreciate the wonderful capability to integrate Claude with Scout platform, very impressive.”

    Workshop attendee, RISE Ireland, Dublin, April 2026

  • “An excellent workshop. Pre-workshop preparation and communications were top notch. The pace for the workshop was just right, as was the contents.”

    Workshop attendee, The Underground Economy Conference, Strasbourg, September 2026

  • “The deep quality of the content. Excellent, detailed.”

    Workshop attendee, RISE Ireland, Dublin, April 2026

  • “Interesting to get hands-on with the MCP and Claude Code. Very relevant to CTI analysts.”

    Workshop attendee, The Underground Economy Conference, Strasbourg, September 2026

  • “Can you do another?”

    Workshop attendee, RISE Ireland, Dublin, April 2026
  • Team Cymru
  • Anthropic

Delivered at The Underground Economy Conference and RISE Ireland

Training in support of the security community

I’ve delivered these workshops at conferences and to investigators from industry, government and law enforcement. If your team or your event would like one, I’d be glad to hear from you.

Ask about a workshop

I usually reply within five business days.