Recently I read the kindle version of “Effective Threat Intelligence: Building and running an intel team for your organization” by James Dietle. I found out after the fact there was a paper back version of it, and even gave one copy away as a Christmas present.
Anyway, this is the book I wish I had in January of 2016, when I moved from Incident Response / Event Analysis to Threat Intelligence. It’s a good primer on the subject. While it’s not completely new material, it’s the basics in one place. When I started doing TI, I had to learn from the ground up, and things were scattered. Some was easy, other parts were more advanced, and nothing made a good how to. Especially when I wanted to start showing value from the word go.
I think that if I had, had this book and read it when I was starting it would have been very beneficial. While it’s not as in depth as SANS For578, I do think that it would make a good primer for anyone in IR going to SANS for Cyber Threat Intelligence.