# Threat Hunting and Detection Engineering (Advanced) Course Canonical URL: ## Overview This course is written for practitioners who already hunt and already write detections, and who now need to grow that work into a program that holds up under scrutiny. Participants take away a repeatable hunting methodology, analytic techniques that cut down on cognitive bias, and the full detection engineering lifecycle from requirement through retirement — along with the validation and metrics practices that show risk is genuinely coming down rather than merely assumed to be. What distinguishes the course is that the methodology itself comes from government sources. Most threat hunting training teaches a vendor's proprietary model; here the hunt process is built from NIST SP 800-53 RA-10 (Threat Hunting), NIST CSF 2.0 Detect outcomes, and the Diamond Model of Intrusion Analysis, a 2013 DoD technical report published through DTIC. Validation rests on NIST SP 800-115 together with the 2024 SP 800-55 measurement guidance, and ATT&CK mapping is done per CISA's guide using its Decider tool. Every element traces to a citable government publication a federal buyer can verify directly, which is rare in this market. The course also counts toward the Cyber Defense & SOC Analyst certificate alongside SOC Foundations and Federal Incident Response, rolling into the Cyber Operations Professional credential. ## What you'll learn - Build a repeatable hunting capability on the foundations of RA-10, CSF 2.0, and the Diamond Model - Operate a plan/conduct/report hunt cycle mapped to CSF 2.0 Detect outcomes - Organize findings against the Diamond Model's four vertices, then pivot into related activity - Translate observed adversary behavior into MITRE ATT&CK technique IDs with CISA's six-step process and the Decider tool - Bring ODNI structured analytic techniques to bear against confirmation bias and anchoring - Gauge program maturity against the CSF 2.0 Implementation Tiers - Take the detection engineering lifecycle from requirement through retirement, validating per NIST SP 800-115 - Produce defensible performance measures drawn from SP 800-53 assessments and SP 800-55 ## Curriculum #### Module 1 Foundations for Advanced Threat Hunting #### Module 2 A Government-Grounded Threat Hunting Methodology #### Module 3 Advanced Hunting Concepts #### Module 4 The Detection Engineering Lifecycle #### Module 5 Validation and Metrics #### Module 6 Program Governance and Synthesis #### Module 7 Capstone Project #### Module 8 Final Assessment ## Schedule - Dec 15, 2026 – Dec 16, 2026 — Live Online - Jan 18, 2027 – Jan 19, 2027 — Live Online - Feb 9, 2027 – Feb 10, 2027 — Live Online - Mar 11, 2027 – Mar 12, 2027 — Live Online - Apr 5, 2027 – Apr 6, 2027 — Live Online - May 17, 2027 – May 18, 2027 — Live Online - Jun 14, 2027 – Jun 15, 2027 — Live Online - Jul 1, 2027 – Jul 2, 2027 — Live Online ## Instructors ### Wes Bryan — Instructor Wes Bryan resides in Gainesville, Florida, and has built his career around technology, education, and helping others understand complex subjects. He values continuous learning, clear communication, and practical problem-solving. Outside of work, Wesley enjoys running, hiking, fishing, and spending time outdoors. He also has a strong interest in music and literature, enjoys reading both fiction and nonfiction, as well as playing guitar. ### Chuck Moore — Instructor With more than 25 years of experience in IT and cybersecurity, Chuck has built a career on a strong foundation in security, networking, help desk operations, and technical training. He has helped organizations strengthen their security posture by identifying vulnerabilities, conducting threat assessments, implementing security controls, and ensuring compliance with industry standards. Combining extensive technical expertise with a passion for education, Chuck equips professionals with the knowledge and practical skills needed to recognize risks, risks and respond effectively. ## Pricing **Tuition:** $1049