🎯 What You'll Learn
- Form testable hunting hypotheses
- Query telemetry to test them
- Recognise attacker behaviour patterns
- Convert hunts into detections
About This Workbook
Threat hunting assumes the adversary is already inside and goes looking. This track teaches the hunting loop — hypothesis, data, analysis, outcome — and how to turn successful hunts into lasting detections.
Chapter 1 — The Hunting Mindset
Assume breach and go looking for it.
- Hunting vs alerting
- The hunt loop
- Frameworks
Chapter 2 — Building Hypotheses
A good hunt starts with a good question.
- Threat-informed hypotheses
- Data requirements
- Scope
Chapter 3 — Hunting in the Data
Finding the needle.
- Querying telemetry
- Behavioural patterns
- Outliers
Chapter 4 — From Hunt to Detection
Making a one-time hunt permanent.
- Documenting findings
- Writing detections
- Feedback loop
Keep going. Work through each chapter in order, then apply what you learned in the matching labs.