You already hunt. You already write detections. What you may not yet have is a program around that work solid enough to survive an audit, a leadership review or a change of staff — and that is precisely what this self-paced course sets out to give you. It covers a hunting methodology you can run again and get comparable results from, analytic techniques that blunt the cognitive biases every hunter carries, and the detection engineering lifecycle end to end, from the requirement that prompts a rule to the decision to retire it. Running alongside all of it are the validation and measurement habits that let you demonstrate risk actually falling, instead of asserting it.
The distinguishing feature is where the methodology comes from. The hunt process is assembled from NIST SP 800-53 RA-10 (Threat Hunting), the Detect outcomes in NIST CSF 2.0, and the Diamond Model of Intrusion Analysis. Validation leans on NIST SP 800-115 alongside the 2024 SP 800-55 measurement guidance, and ATT&CK mapping follows CISA's own guide and its Decider tool. Every piece traces back to a citable public standard that a buyer can go and check.
What You Will Learn
- Build a repeatable hunting capability on the foundations of RA-10, CSF 2.0, and the Diamond Model
- Operate a plan/conduct/report hunt cycle mapped to CSF 2.0 Detect outcomes
- Organize findings against the Diamond Model's four vertices, then pivot into related activity
- Translate observed adversary behavior into MITRE ATT&CK technique IDs with CISA's six-step process and the Decider tool
- Bring structured analytic techniques to bear against confirmation bias and anchoring
- Gauge program maturity against the CSF 2.0 Implementation Tiers
- Take the detection engineering lifecycle from requirement through retirement, validating per NIST SP 800-115
- Produce defensible performance measures drawn from SP 800-53 assessments and SP 800-55
Course Outline
Module 1
Foundations for Advanced Threat Hunting
Module 2
A Government-Grounded Threat Hunting Methodology
Module 3
Advanced Hunting Concepts
Module 4
The Detection Engineering Lifecycle
Module 5
Validation and Metrics
Module 6
Program Governance and Synthesis
Module 7
Capstone Project
Module 8
Final Assessment
This course is available for 365 days. You can choose when to start your access period. Once you activate, you will have 365 days to complete it (access the course materials, quizzes, projects and videos). You may request one extension of seven (7) days. Other extension requests will be evaluated on a case-by-case basis. Videos are not downloadable.
