- What Domain 8 Actually Tests
- CyberLive Questions and the Hands-On Component
- Core Technical Skills for Domain 8
- Applying Kill Chain, Diamond Model, and STIX in Practice
- Writing Intelligence Reports for Executive Audiences
- Open-Book Strategy for Practical Questions
- A Domain-Anchored Study Schedule
- Registration, Fees, and Activation Window
- Frequently Asked Questions
- Domain 8 synthesizes every prior GCTI domain into live, scenario-driven tasks-not just multiple-choice recall.
- CyberLive items run in actual virtual environments; you must collect, pivot, analyze, and report under timed conditions.
- The exam is 82 questions in 3 hours with a 71% passing threshold and allows printed notes only-no electronic references.
- YARA rules, STIX/TAXII, OpenIOC, and intelligence report writing for executives are all fair game in Domain 8 tasks.
What Domain 8 Actually Tests
Every domain from 1 through 7 builds toward a single destination: the ability to do cyber threat intelligence work, not just describe it. Domain 8-Practical Application of Threat Intelligence-is where GIAC verifies that you can execute the full intelligence cycle under exam pressure, in a live environment, against realistic adversary scenarios. It is the capstone domain of the GIAC Cyber Threat Intelligence (GCTI) certification, and it rewards candidates who have genuinely internalized the preceding material rather than those who have memorized definitions.
Where earlier domains isolate specific competencies-GCTI Domain 8: Practical Application of Threat Intelligence Study Guide 2026 sits at the intersection of collection, analysis, pivoting, and reporting-Domain 8 tasks require you to chain those skills together. A single question may ask you to identify an indicator in a sample, pivot to related infrastructure using OSINT techniques from Domain 4, map the activity to a Diamond Model feature from Domain 2, and then determine the appropriate sharing format from Domain 7. That chain of reasoning is what separates certified practitioners from people who passed a terminology quiz.
CyberLive Questions and the Hands-On Component
The GCTI exam consists of 82 questions delivered in 3 hours, and a subset of those questions are CyberLive items. These are not simulations or drag-and-drop diagrams-they run inside live virtual environments provided by GIAC's exam platform. You are given a real toolset, real-looking data, and a specific task to complete.
CyberLive items in Domain 8 territory typically involve one or more of the following workflows:
- Indicator extraction and validation: Given a malware sample or log file, identify IOCs and confirm their relevance to the described threat scenario.
- YARA rule construction or evaluation: Write a YARA rule that matches a described artifact, or assess whether an existing rule produces accurate hits.
- STIX/TAXII object creation: Build or interpret a STIX bundle representing a threat actor's campaign, relationships, and indicators.
- OpenIOC authoring: Construct a structured OpenIOC document that captures the forensic logic of an intrusion set.
- Pivoting tasks: Use passive DNS, WHOIS history, SSL certificate data, or other OSINT sources to expand from a seed indicator to related adversary infrastructure.
- Intelligence report drafting: Produce a brief finished intelligence product appropriate for a specified audience-technical team versus executive leadership.
Because these tasks are executed in live environments, your speed matters. You have roughly 2 minutes and 12 seconds per question on average across the full 82-question exam-but CyberLive items routinely take longer. Candidates who struggle with the practical component are usually those who studied concepts in isolation rather than practicing the full workflow end-to-end.
Key Takeaway
Do not treat CyberLive preparation as separate from content review. Every time you study a technique-YARA syntax, Diamond Model application, STIX relationships-practice it in a live tool environment. The exam rewards muscle memory, not just understanding.
Core Technical Skills for Domain 8
Domain 8 presupposes fluency in the technical skills introduced in earlier domains. The following are the highest-priority competencies to solidify before exam day.
YARA Rule Writing and Analysis
YARA is the de facto standard for describing malware families based on textual or binary patterns. Domain 8 tasks may ask you to create a rule from scratch given a described artifact, tune an existing rule to reduce false positives, or interpret a rule's logic to predict what it will and will not match.
- Know the full syntax:
ruleblocks,stringssections (text, hex, regex), andconditionlogic. - Understand boolean operators, offsets, and the
any of/all ofconstructs. - Practice writing rules against real malware samples in a sandbox environment before the exam.
STIX 2.x Object Modeling
STIX (Structured Threat Information eXpression) is the primary sharing language for cyber threat intelligence, and Domain 8 tasks will require you to understand how threat actors, campaigns, attack patterns, indicators, and relationships are modeled as STIX Domain Objects (SDOs) and STIX Relationship Objects (SROs).
- Know the core SDO types:
threat-actor,campaign,attack-pattern,indicator,malware,tool,course-of-action. - Understand how TAXII servers distribute STIX bundles and the client-server pull/push model.
- Be able to trace a relationship chain from an indicator back to a threat actor through multiple SROs.
OpenIOC Structure and Logic
OpenIOC uses a tree-based AND/OR logic structure to describe the observable artifacts of a compromise. Domain 8 may ask you to construct an OpenIOC document that accurately captures a described intrusion, or to evaluate whether a given document would correctly identify a compromise based on the evidence provided.
- Master the IndicatorItem syntax and the difference between AND (all conditions must match) and OR (any condition matches) nodes.
- Know common OpenIOC terms for file artifacts, registry keys, network connections, and process behavior.
- Practice translating a narrative intrusion description into a valid OpenIOC structure.
Applying Kill Chain, Diamond Model, and STIX in Practice
Domain 2 introduced the Lockheed Martin Kill Chain and the Diamond Model as analytical frameworks. Domain 8 demands that you apply them-not just name their components. In practical tasks, this means mapping observed adversary behavior to specific Kill Chain phases or Diamond Model vertices, and then using that mapping to inform a defensive recommendation or an intelligence report.
Consider a scenario where you are given a collection of network logs, a dropped executable, and a list of command-and-control callbacks. A Domain 8 task might ask you to:
- Identify which Kill Chain phase the observed behavior represents.
- Populate the Diamond Model vertices (adversary, capability, infrastructure, victim) using the available evidence.
- Determine what additional collection is needed to complete the adversary profile.
- Select the appropriate STIX objects to represent this activity for sharing with a partner organization via TAXII.
This kind of chained analytical task is the heart of Domain 8. Candidates who can walk through each step fluidly-without pausing to recall what the Diamond Model's vertices are-will have significant time advantages on CyberLive items.
Writing Intelligence Reports for Executive Audiences
One of the most underestimated competencies in Domain 8 is intelligence report writing-specifically the ability to communicate threat findings to non-technical executive audiences. The GCTI certification explicitly covers strategic, operational, and tactical threat intelligence, and each level requires a different communication register.
| Intelligence Type | Audience | Focus | Format Characteristics |
|---|---|---|---|
| Strategic | C-suite, board members | Threat landscape, business risk, geopolitical context | Narrative prose, minimal jargon, risk framing, 1-2 pages |
| Operational | Security managers, IR leads | Specific campaigns, TTPs, timelines | Structured report with indicators, actor profile, timeline |
| Tactical | SOC analysts, malware reverse engineers | IOCs, YARA rules, signatures, raw artifacts | Technical appendices, structured data, STIX bundles |
Exam tasks at the Domain 8 level may ask you to produce a brief intelligence product or to evaluate whether a given report section is appropriate for its stated audience. A common mistake is producing tactically-heavy reports for executive audiences-loading an executive brief with IP addresses and file hashes rather than business impact language and risk recommendations.
Open-Book Strategy for Practical Questions
The GCTI exam is open-book, but with a critical constraint: only printed materials are permitted. No electronic devices, no internet access, no digital files on a laptop. This changes the nature of open-book entirely. You are not Googling syntax-you are flipping through a physical index you built yourself.
For Domain 8 specifically, your printed notes should include the following reference material:
- YARA syntax cheat sheet with common condition patterns and string modifiers
- STIX 2.x SDO and SRO type reference with required and optional properties
- OpenIOC term reference organized by category (file, network, process, registry)
- Kill Chain phase definitions with example behaviors per phase
- Diamond Model vertex definitions with example adversary, capability, infrastructure, and victim attributes
- Intelligence report structure templates for strategic, operational, and tactical products
For a comprehensive breakdown of what materials are and are not permitted during the exam, review the GCTI Open Book Policy: What You Can Bring to the Exam-it covers tab organization strategies and pagination approaches that save critical minutes on exam day.
The key insight: your printed notes are most valuable for factual lookups on multiple-choice questions, not for CyberLive tasks. By the time you are inside a live environment executing a pivoting workflow, you should not be stopping to consult notes on basic STIX syntax. That material needs to be internalized. Save your notes for confirming edge cases-unusual YARA modifiers, specific TAXII endpoint configurations, or exact OpenIOC term names.
A Domain-Anchored Study Schedule
Because Domain 8 is integrative, the most effective preparation strategy front-loads earlier domains and reserves the final weeks for synthesis and hands-on practice. The schedule below assumes roughly 10-15 hours per week of dedicated study time.
Foundations: Domains 1 and 2
- Master intelligence cycle terminology from Domain 1 (Fundamentals of Cyber Threat Intelligence)
- Drill Kill Chain phases and Diamond Model vertices from Domain 2 until they are automatic recall
- Begin building your printed reference binder with framework reference sheets
Collection and OSINT: Domains 3 and 4
- Cover intelligence collection sources and collection planning from Domain 3
- Practice OSINT pivoting workflows from Domain 4 in live environments (passive DNS, WHOIS, certificate transparency)
- Add OSINT tool cheat sheets to your binder
Malware and Pivoting: Domains 5 and 6
- Study malware analysis fundamentals and threat attribution methodology from Domain 5
- Practice pivoting from indicators to infrastructure using Domain 6 techniques
- Write and test at least five YARA rules against sample artifacts
Storage, Sharing, and Reporting: Domain 7
- Master STIX 2.x object types and TAXII client-server model from Domain 7
- Practice OpenIOC document construction
- Draft strategic, operational, and tactical intelligence report examples
Synthesis: Domain 8 Integration Practice
- Work through full end-to-end scenarios chaining collection, analysis, pivoting, and reporting
- Take timed practice tests on the GCTI practice test platform and review every incorrect answer at the domain level
- Finalize and index your printed binder; practice timed lookups under simulated exam conditions
Registration, Fees, and Activation Window
Understanding the financial and logistical structure of the GCTI exam helps you plan without surprises. The standalone exam attempt costs $979 USD. If you need to retake, the retake fee is approximately $899. A standalone practice test-separate from any included in a course bundle-costs $399. These are meaningful investments, and the 71% passing threshold means that underprepared candidates are paying full retake fees.
Once you purchase your exam attempt, you have a 120-day activation window to schedule and complete the exam. This window begins at purchase, not at scheduling, so plan your study timeline before you buy. If you intend to take SANS FOR578 as preparation-the course GIAC recommends-note that bundling the course with an exam attempt typically includes two practice tests and brings the total investment to approximately $8,780 for the course alone. The practice tests included in that bundle are valuable; use both of them, spaced out across your preparation period.
The exam is delivered either via ProctorU remote proctoring or at a Pearson VUE onsite testing center. Remote proctoring requires a stable internet connection and a clean testing environment; onsite centers eliminate technical variables but require scheduling around location availability. The exam itself is ANAB ISO/IEC 17024 accredited, which matters for candidates in government or regulated industries where credential accreditation is a contractual requirement.
Certification is valid for 4 years. Renewal requires either 36 Continuing Professional Education (CPE) credits or passing the current version of the exam, with a $499 renewal fee. GIAC offers discounts for renewing multiple certifications simultaneously-relevant for candidates who hold other GIAC credentials alongside GCTI.
When you are ready to test your readiness before committing to the exam date, practicing on a realistic GCTI question set is the most efficient way to identify which domains still need work. The GCTI Open Book Policy guide is essential reading before your final preparation week.
Frequently Asked Questions
No formal prerequisites exist for the GCTI exam. However, Domain 8 CyberLive tasks assume working familiarity with YARA syntax and STIX 2.x object modeling. If you are new to either, build hands-on experience in a lab environment during Weeks 3 and 4 of your preparation, well before exam day. SANS FOR578 covers both topics in depth if you are taking the course.
GIAC does not publicly disclose the exact number of CyberLive items within the 82-question exam. What is confirmed is that CyberLive items test practical skills in threat intelligence collection, analysis, pivoting, and reporting. Prepare for both formats equally-multiple-choice questions can be conceptually dense, and CyberLive items are time-consuming. Neither format should catch you unprepared.
No. The GCTI exam is open-book with printed materials only. Electronic devices, internet access, and digital reference files are not permitted. Your STIX object type references, YARA syntax guides, and framework cheat sheets must be printed and brought to the exam in physical form. For a full breakdown of permitted materials, see the GCTI Open Book Policy: What You Can Bring to the Exam.
The GCTI is targeted at professionals in threat intelligence analyst, threat hunter, incident responder, and security operations roles. Government agencies, defense contractors, financial sector security teams, and managed security service providers actively seek GCTI-certified candidates. The certification's practical component-verified through CyberLive-signals that the holder can perform intelligence work immediately, not just discuss it theoretically.
GIAC does not publicly disclose domain weighting percentages for the GCTI exam. However, because Domain 8 encompasses the practical application of all prior domains and includes CyberLive hands-on items-which are inherently more complex and time-consuming than multiple-choice questions-effective preparation for Domain 8 requires mastery of every preceding domain. Treat the earlier domains as prerequisites, not separate topics.
Ready to Start Practicing?
Test your Domain 8 readiness with realistic GCTI practice questions covering YARA rule analysis, STIX/TAXII modeling, intelligence report writing, and full-scenario pivoting tasks. Identify your weak domains now-before the $979 exam attempt is on the line.
Start Free Practice Test