# Threat Hunting and Detection Engineering (Advanced) Canonical URL: ## Overview This course is written for practitioners who already hunt and already write detections, and who now need to grow that work into a program that holds up under scrutiny. Participants take away a repeatable hunting methodology, analytic techniques that cut down on cognitive bias, and the full detection engineering lifecycle from requirement through retirement — along with the validation and metrics practices that show risk is genuinely coming down rather than merely assumed to be. What distinguishes the course is that the methodology itself is drawn from published standards rather than invented in-house. Most threat hunting training teaches a vendor's proprietary model; here the hunt process is built from NIST SP 800-53 RA-10 (Threat Hunting), NIST CSF 2.0 Detect outcomes, and the Diamond Model of Intrusion Analysis. Validation rests on NIST SP 800-115 together with the 2024 SP 800-55 measurement guidance, and ATT&CK mapping is done per CISA's guide using its Decider tool. Every element traces to a citable public standard a buyer can verify directly, which is rare in this market. ## What you'll learn - Build a repeatable hunting capability on the foundations of RA-10, CSF 2.0, and the Diamond Model - Operate a plan/conduct/report hunt cycle mapped to CSF 2.0 Detect outcomes - Organize findings against the Diamond Model's four vertices, then pivot into related activity - Translate observed adversary behavior into MITRE ATT&CK technique IDs with CISA's six-step process and the Decider tool - Bring structured analytic techniques to bear against confirmation bias and anchoring - Gauge program maturity against the CSF 2.0 Implementation Tiers - Take the detection engineering lifecycle from requirement through retirement, validating per NIST SP 800-115 - Produce defensible performance measures drawn from SP 800-53 assessments and SP 800-55 ## Prerequisites This is an advanced course. Participants should already be hunting threats and writing detections, with daily hands-on experience in a SIEM and an EDR platform. It is not an entry point into security operations. ## Schedule - Jan 18, 2027 – Jan 19, 2027 — Live Online - Mar 11, 2027 – Mar 12, 2027 — Live Online - Apr 5, 2027 – Apr 6, 2027 — Live Online - Jun 14, 2027 – Jun 15, 2027 — Live Online - Jul 1, 2027 – Jul 2, 2027 — Live Online ## Pricing **Tuition:** $1049