# Threat Hunting and Detection Engineering (Advanced) (Self-Paced)

Canonical URL: <https://www.nobledesktop.com/classes/threat-hunting-and-detection-engineering-advanced-self-paced>

## Overview

You already hunt. You already write detections. What you may not yet have is a program around that work solid enough to survive an audit, a leadership review or a change of staff — and that is precisely what this self-paced course sets out to give you. It covers a hunting methodology you can run again and get comparable results from, analytic techniques that blunt the cognitive biases every hunter carries, and the detection engineering lifecycle end to end, from the requirement that prompts a rule to the decision to retire it. Running alongside all of it are the validation and measurement habits that let you demonstrate risk actually falling, instead of asserting it.

The distinguishing feature is where the methodology comes from. Most training in this space hands you a vendor's proprietary model; here the hunt process is assembled from NIST SP 800-53 RA-10 (Threat Hunting), the Detect outcomes in NIST CSF 2.0, and the Diamond Model of Intrusion Analysis. Validation leans on NIST SP 800-115 alongside the 2024 SP 800-55 measurement guidance, and ATT&CK mapping follows CISA's own guide and its Decider tool. Every piece traces back to a citable public standard that a buyer can go and check, which almost nothing else in this market can claim.

## What you'll learn

- Build a repeatable hunting capability on the foundations of RA-10, CSF 2.0, and the Diamond Model
- Operate a plan/conduct/report hunt cycle mapped to CSF 2.0 Detect outcomes
- Organize findings against the Diamond Model's four vertices, then pivot into related activity
- Translate observed adversary behavior into MITRE ATT&CK technique IDs with CISA's six-step process and the Decider tool
- Bring structured analytic techniques to bear against confirmation bias and anchoring
- Gauge program maturity against the CSF 2.0 Implementation Tiers
- Take the detection engineering lifecycle from requirement through retirement, validating per NIST SP 800-115
- Produce defensible performance measures drawn from SP 800-53 assessments and SP 800-55

## Prerequisites

This is an advanced course. Participants should already be hunting threats and writing detections, with daily hands-on experience in a SIEM and an EDR platform. It is not an entry point into security operations.

## Pricing

**Tuition:** $1049