Threat Hunting and Detection Engineering (Advanced) Course
IDCYSE8008

This course is written for practitioners who already hunt and already write detections, and who now need to grow that work into a program that holds up under scrutiny. Participants take away a repeatable hunting methodology, analytic techniques that cut down on cognitive bias, and the full detection engineering lifecycle from requirement through retirement — along with the validation and metrics practices that show risk is genuinely coming down rather than merely assumed to be.

What distinguishes the course is that the methodology itself comes from government sources. Most threat hunting training teaches a vendor's proprietary model; here the hunt process is built from NIST SP 800-53 RA-10 (Threat Hunting), NIST CSF 2.0 Detect outcomes, and the Diamond Model of Intrusion Analysis, a 2013 DoD technical report published through DTIC. Validation rests on NIST SP 800-115 together with the 2024 SP 800-55 measurement guidance, and ATT&CK mapping is done per CISA's guide using its Decider tool. Every element traces to a citable government publication a federal buyer can verify directly, which is rare in this market. The course also counts toward the Cyber Defense & SOC Analyst certificate alongside SOC Foundations and Federal Incident Response, rolling into the Cyber Operations Professional credential.