This course is written for practitioners who already hunt and already write detections, and who now need to grow that work into a program that holds up under scrutiny. Participants take away a repeatable hunting methodology, analytic techniques that cut down on cognitive bias, and the full detection engineering lifecycle from requirement through retirement — along with the validation and metrics practices that show risk is genuinely coming down rather than merely assumed to be.
What distinguishes the course is that the methodology itself is drawn from published standards rather than invented in-house. Most threat hunting training teaches a vendor's proprietary model; here the hunt process is built from NIST SP 800-53 RA-10 (Threat Hunting), NIST CSF 2.0 Detect outcomes, and the Diamond Model of Intrusion Analysis. Validation rests on NIST SP 800-115 together with the 2024 SP 800-55 measurement guidance, and ATT&CK mapping is done per CISA's guide using its Decider tool. Every element traces to a citable public standard a buyer can verify directly, which is rare in this market.
From our hands-on training style to world-class instructors and custom-crafted curriculum, we deliver results our alumni are proud of.
Learn the concepts and skills covered in this course or your tuition is on us. See details and terms & conditions.
Work on projects proven to boost retention
Refined over many cohorts for an optimal learning experience
The teaching method at Noble Desktop is perfect and the classes provide you with infinite knowledge that makes you eager to take everything they offer. I love Noble!
—Ivonne Ackerman
Experienced educators who are driven to help you succeed
Refresh the materials for free within one year
Attend this course live online or as self-paced training. Engage with expert instructors, ask questions, and get feedback on your exercises and projects.
Unlike other providers, these are not mass open-enrollment classes. At Noble Desktop, you’ll learn in small groups (typically 8-15 students) and receive personalized attention.
Get the same interactivity and access to the instructor as in-person students. There are no extra fees and we’ll work with you to ensure your remote setup is perfect.
Learn at your own pace with pre-recorded video lessons and hands-on exercises. Work through the material on your schedule with access to course content and resources.
Upon completion of this course, you’ll receive an official certificate testifying to your mastery of the curriculum. We’ll send you a link where you can download your certificate, share it online with your friends, post it to your professional network on LinkedIn, and view all your earned certificates. Congratulations on your achievement!
Shareable on
We offer a single free retake of the class within a year.
Written for Tier II and Tier III SOC analysts, threat hunters, detection engineers, and security engineers already working with SIEM and EDR daily. This is not an entry point into security operations.
Yes, this course is open to beginners. Students must be comfortable using a computer. No other prior knowledge is required.
This course does not qualify for payment plans or student financing. See our Payment Plan FAQ to find related programs that qualify.
Yes. This course is available online. See the course description and enrollment options for the training format and schedule.
For live-online sessions, you attend at the scheduled class times (New York, Eastern Time).
You have some options:
There are no extra fees or taxes for our courses. The price you see on this page is the maximum you’ll pay us.
We don’t currently offer discounts as we do our best to affordably prices our courses.
