Advanced Campaign tracking Mastery: Field Guide

RCCE students will learn threat actor campaign tracking including activity clustering, attribution analysis, infrastructure tracking, and campaign timeline reconstruction. RCCE students will learn to identify and track related threat activity across incidents, cluster threat actor campaigns using technical indicators, behavioral patterns, and targeting profiles, maintain campaign timelines and infrastructure databases, perform attribution analysis using diamond model and other analytic frameworks, produce campaign intelligence reports that inform defensive priorities, share campaign intelligence with trusted partners and ISACs, and update detections based on evolving campaign TTPs. This advanced mastery course challenges experienced practitioners with complex scenarios, expert-level techniques, and nuanced decision-making. At an expert level, RCCE students will learn to handle the most demanding situations in this domain, developing the expertise expected of senior security professionals. Students tackle multi-layered problems that require synthesizing knowledge across multiple disciplines.