Threat Hunting and Detection Engineering (Advanced)

This course is written for practitioners who already hunt and already write detections, and who now need to grow that work into a program that holds up under scrutiny. Participants take away a repeatable hunting methodology, analytic techniques that cut down on cognitive bias, and the full detection engineering lifecycle from requirement through retirement — along with the validation and metrics practices that show risk is genuinely coming down rather than merely assumed to be.

What distinguishes the course is that the methodology itself is drawn from published standards rather than invented in-house. The hunt process is built from NIST SP 800-53 RA-10 (Threat Hunting), NIST CSF 2.0 Detect outcomes, and the Diamond Model of Intrusion Analysis. Validation rests on NIST SP 800-115 together with the 2024 SP 800-55 measurement guidance, and ATT&CK mapping is done per CISA's guide using its Decider tool. Every element traces to a citable public standard a buyer can verify directly.

What You Will Learn

• Build a repeatable hunting capability on the foundations of RA-10, CSF 2.0, and the Diamond Model
• Operate a plan/conduct/report hunt cycle mapped to CSF 2.0 Detect outcomes
• Organize findings against the Diamond Model's four vertices, then pivot into related activity
• Translate observed adversary behavior into MITRE ATT&CK technique IDs with CISA's six-step process and the Decider tool
• Bring structured analytic techniques to bear against confirmation bias and anchoring
• Gauge program maturity against the CSF 2.0 Implementation Tiers
• Take the detection engineering lifecycle from requirement through retirement, validating per NIST SP 800-115
• Produce defensible performance measures drawn from SP 800-53 assessments and SP 800-55

Course Outline

Module 1

Foundations for Advanced Threat Hunting

Module 2

A Government-Grounded Threat Hunting Methodology

Module 3

Advanced Hunting Concepts

Module 4

The Detection Engineering Lifecycle

Module 5

Validation and Metrics

Module 6

Program Governance and Synthesis

Module 7

Capstone Project

Module 8

Final Assessment