Threat Hunting and Detection Engineering (Advanced) (Self-Paced)

Self-paced online training with expert support

Stop hunting by instinct. Build the same work into a program that can be repeated, measured and defended — on open, published standards, not a vendor's proprietary framework.

$1,049 12 clock hours Live Support Start anytime

This course includes

  • 12 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Access to class recordings (30 days)
  • Verified digital certificate of completion

This is the self-paced version. For live instruction, enroll in Threat Hunting and Detection Engineering (Advanced).

You already hunt. You already write detections. What you may not yet have is a program around that work solid enough to survive an audit, a leadership review or a change of staff — and that is precisely what this self-paced course sets out to give you. It covers a hunting methodology you can run again and get comparable results from, analytic techniques that blunt the cognitive biases every hunter carries, and the detection engineering lifecycle end to end, from the requirement that prompts a rule to the decision to retire it. Running alongside all of it are the validation and measurement habits that let you demonstrate risk actually falling, instead of asserting it.

The distinguishing feature is where the methodology comes from. Most training in this space hands you a vendor's proprietary model; here the hunt process is assembled from NIST SP 800-53 RA-10 (Threat Hunting), the Detect outcomes in NIST CSF 2.0, and the Diamond Model of Intrusion Analysis. Validation leans on NIST SP 800-115 alongside the 2024 SP 800-55 measurement guidance, and ATT&CK mapping follows CISA's own guide and its Decider tool. Every piece traces back to a citable public standard that a buyer can go and check, which almost nothing else in this market can claim.

Read more

This course has a prerequisite

This is an advanced course. Participants should already be hunting threats and writing detections, with daily hands-on experience in a SIEM and an EDR platform. It is not an entry point into security operations.

Yelp Facebook LinkedIn YouTube Twitter Instagram