This course is written for practitioners who already hunt and already write detections, and who now need to grow that work into a program that holds up under scrutiny. Participants take away a repeatable hunting methodology, analytic techniques that cut down on cognitive bias, and the full detection engineering lifecycle from requirement through retirement — along with the validation and metrics practices that show risk is genuinely coming down rather than merely assumed to be.
What distinguishes the course is that the methodology itself comes from government sources. Most threat hunting training teaches a vendor's proprietary model; here the hunt process is built from NIST SP 800-53 RA-10 (Threat Hunting), NIST CSF 2.0 Detect outcomes, and the Diamond Model of Intrusion Analysis, a 2013 DoD technical report published through DTIC. Validation rests on NIST SP 800-115 together with the 2024 SP 800-55 measurement guidance, and ATT&CK mapping is done per CISA's guide using its Decider tool. Every element traces to a citable government publication a federal buyer can verify directly, which is rare in this market. The course also counts toward the Cyber Defense & SOC Analyst certificate alongside SOC Foundations and Federal Incident Response, rolling into the Cyber Operations Professional credential.
Target Audience
Written for Tier II and Tier III SOC analysts, threat hunters, detection engineers, and security engineers already working with SIEM and EDR daily. This is not an entry point into security operations.
What You'll Learn at a Glance
- Build a repeatable hunting capability on the foundations of RA-10, CSF 2.0, and the Diamond Model
- Operate a plan/conduct/report hunt cycle mapped to CSF 2.0 Detect outcomes
- Organize findings against the Diamond Model's four vertices, then pivot into related activity
- Translate observed adversary behavior into MITRE ATT&CK technique IDs with CISA's six-step process and the Decider tool
- Bring ODNI structured analytic techniques to bear against confirmation bias and anchoring
- Gauge program maturity against the CSF 2.0 Implementation Tiers
- Take the detection engineering lifecycle from requirement through retirement, validating per NIST SP 800-115
- Produce defensible performance measures drawn from SP 800-53 assessments and SP 800-55
Course Syllabus
- Module 1
- Foundations for Advanced Threat Hunting
- Module 2
- A Government-Grounded Threat Hunting Methodology
- Module 3
- Advanced Hunting Concepts
- Module 4
- The Detection Engineering Lifecycle
- Module 5
- Module 6
- Program Governance and Synthesis
- Module 7
- Module 8
This course is available for "remote" learning and will be available to anyone with access to an internet device with a microphone (this includes most models of computers, tablets). Classes will take place with a "Live" instructor at the date/times listed below.
Upon registration, the instructor will send along additional information about how to log-on and participate in the class.
