Threat Hunting & Detection Engineering Training Course

Shows how to build hunting hypotheses, analyse endpoint, network and identity telemetry, and engineer detections that catch advanced threats earlier.

TICM · Threat Intelligence & Cyber Threat ManagementAll Levels#2535ClassroomEnglish , Arabic

Duration

5 Days

Download Brochure View Upcoming Dates

Free substitution at any time · 30+ days' notice: full refund minus 10%. Cancellation policy

Sectors:Information Technology & CybersecurityCategories:Threat Intelligence & Cyber Threat Management

Course Overview

This advanced practical course develops the capabilities required to proactively identify sophisticated cyber threats and engineer effective detection mechanisms across enterprise environments. It combines threat hunting methodologies with detection engineering practices to help security teams move beyond reactive alert handling toward proactive discovery and continuous improvement. The program covers threat hunting methodologies, hypothesis development, threat intelligence integration, telemetry analysis, detection logic, analytics, behavioral indicators, endpoint and network data, detection rules, alert quality, and validation. Participants learn how to transform threat intelligence and adversary behaviour into measurable detection capabilities that support security operations. Through practical hunting scenarios and detection engineering workshops, participants will investigate suspicious activities, develop hunting hypotheses, analyse security telemetry, create and validate detection logic, reduce false positives, identify detection gaps, and improve coverage against evolving attack techniques.

Learning Objectives

Analyse the principles and operating models of threat hunting and detection engineering.
Develop threat hunting hypotheses based on risks, intelligence, and adversary behaviour.
Identify and evaluate telemetry required for effective threat detection.
Analyse endpoint, network, identity, application, and cloud security data.
Apply structured techniques for proactive threat hunting.
Translate adversary tactics, techniques, and procedures into detection requirements.
Design detection logic based on behavioural and technical indicators.
Develop and validate detection rules for security monitoring environments.
Evaluate detection quality, false positives, false negatives, and alert effectiveness.
Identify detection coverage gaps and prioritize improvements.
Integrate threat intelligence, hunting, detection, and incident response workflows.
Develop a continuous threat hunting and detection engineering improvement framework.

Who Should Attend

This course is designed for threat hunters, detection engineers, security operations centre analysts, cybersecurity analysts, incident responders, threat intelligence professionals, security engineers, and security monitoring specialists. It is also suitable for SOC managers, cybersecurity managers, threat researchers, security architects, vulnerability management professionals, digital forensics specialists, and technical leads responsible for improving enterprise detection and response capabilities. The program is particularly relevant to organizations seeking to strengthen proactive threat discovery, improve detection coverage, reduce ineffective alerts, and build a structured detection engineering capability aligned with current and emerging attack techniques.

Learning Outcomes

Explain the relationship between threat hunting, detection engineering, and security operations.
Develop structured threat hunting hypotheses from intelligence and security risks.
Identify relevant telemetry and data sources for hunting activities.
Analyse endpoint, network, identity, application, and cloud security events.
Investigate suspicious behaviours using systematic hunting techniques.
Map adversary behaviours to relevant tactics, techniques, and procedures.
Translate hunting findings into actionable detection requirements.
Develop and test behavioural and technical detection logic.
Validate detection rules using realistic attack scenarios.
Assess false positives, false negatives, alert quality, and detection effectiveness.
Identify gaps in detection coverage and prioritize engineering improvements.
Establish an integrated framework for continuous hunting and detection improvement.

Course Outline

Day 1

Threat Hunting Foundations, Methodologies & Hypothesis Development

Threat hunting principles and objectives
Proactive versus reactive security operations
Threat hunting lifecycle
Intelligence-driven hunting
Threat hunting hypotheses
Risk-based hunting priorities
Adversary behaviour and attack patterns
Threat modelling for hunting activities
Data sources and telemetry requirements
Hunting workflows and documentation
Practical Application: Developing threat hunting hypotheses from a simulated threat intelligence scenario

Day 2

Security Telemetry, Data Analysis & Adversary Behaviour

Endpoint telemetry and process activity
Network traffic and communication data
Identity and authentication events
Application and cloud activity
Security logs and event correlation
Behavioural indicators and anomalies
Indicators of compromise and indicators of attack
Adversary tactics, techniques, and procedures
Correlating events across multiple data sources
Identifying suspicious activity and attack patterns
Practical Application: Analysing multi-source security telemetry to identify a simulated adversary activity

Day 3

Detection Engineering & Detection Logic

Detection engineering principles
From threat intelligence to detection requirements
Detection use cases and security objectives
Behaviour-based versus indicator-based detection
Detection logic and rule development
Event correlation and analytical conditions
Detection coverage and attack technique mapping
Detection tuning and optimization
Alert prioritization and contextual enrichment
Detection documentation and lifecycle management
Practical Application: Designing detection logic for selected adversary techniques and developing corresponding detection rules

Day 4

Detection Validation, Threat Investigation & Response Integration

Detection testing and validation
Attack simulation and detection verification
False positives and false negatives
Alert quality and operational effectiveness
Detection gap analysis
Threat investigation using detection results
Escalation and incident response integration
Threat intelligence enrichment
Detection performance measurement
Improving detection accuracy and coverage
Practical Application: Testing detection rules against simulated attack activity and refining them to improve accuracy and reduce unnecessary alerts

Day 5

Advanced Threat Hunting, Detection Coverage & Continuous Improvement

Advanced hunting techniques
Threat-led detection engineering
Detection coverage assessment
Prioritizing detection gaps
Measuring hunting and detection effectiveness
Detection maturity and operational metrics
Collaboration between threat hunters, SOC, intelligence, and incident response teams
Detection content lifecycle management
Continuous tuning and improvement
Building a sustainable threat hunting capability
Final Workshop: Developing an integrated threat hunting and detection engineering framework covering intelligence, hypotheses, telemetry, analysis, detection development, validation, response integration, coverage assessment, and continuous improvement

Upcoming Dates

Selected date

Geneva · 30 Aug – 3 Sept 2027 · Classroom

Need more details?Chat with us on WhatsApp

City	Dates	Price per Participant	Early Bird
MunichScheduled	2 – 6 Nov 2026	€6,000	—	Select Download Brochure
MuscatScheduled	9 – 13 Nov 2026	€6,300	—	Select Download Brochure
OnlineScheduled	15 – 19 Nov 2026	€2,700	—	Select Download Brochure
ParisScheduled	23 – 27 Nov 2026	€6,700	—	Select Download Brochure
RiyadhScheduled	23 – 27 Nov 2026	€4,800	—	Select Download Brochure
RomeScheduled	30 Nov – 4 Dec 2026	€7,000	€6,300until 9 Nov	Select Download Brochure
SalalahScheduled	7 – 11 Dec 2026	€6,300	€5,670until 16 Nov	Select Download Brochure
SingaporeScheduled	14 – 18 Dec 2026	€8,000	€7,200until 23 Nov	Select Download Brochure
TrabzonScheduled	21 – 25 Dec 2026	€5,300	€4,770until 30 Nov	Select Download Brochure
TunisiaScheduled	28 Dec 2026 – 1 Jan 2027	€4,300	€3,870until 7 Dec	Select Download Brochure
ViennaScheduled	4 – 8 Jan 2027	€6,400	€5,760until 14 Dec	Select Download Brochure
AmmanScheduled	10 – 14 Jan 2027	€4,000	€3,600until 21 Dec	Select Download Brochure
AmsterdamScheduled	11 – 15 Jan 2027	€6,000	€5,400until 21 Dec	Select Download Brochure
BakuScheduled	18 – 22 Jan 2027	€5,300	€4,770until 28 Dec	Select Download Brochure
BarcelonaScheduled	25 – 29 Jan 2027	€6,000	€5,400until 4 Jan	Select Download Brochure
CairoScheduled	1 – 5 Feb 2027	€3,800	€3,420until 11 Jan	Select Download Brochure
CasablancaScheduled	8 – 12 Feb 2027	€4,700	€4,230until 18 Jan	Select Download Brochure
DammamScheduled	15 – 19 Feb 2027	€4,800	€4,320until 25 Jan	Select Download Brochure
DohaScheduled	22 – 26 Feb 2027	€4,700	€4,230until 1 Feb	Select Download Brochure
DubaiScheduled	28 Feb – 4 Mar 2027	€4,700	€4,230until 8 Feb	Select Download Brochure
GenevaScheduled	1 – 5 Mar 2027	€7,300	€6,570until 8 Feb	Select Download Brochure
IstanbulScheduled	8 – 12 Mar 2027	€5,300	€4,770until 15 Feb	Select Download Brochure
Kuala LumpurScheduled	15 – 19 Mar 2027	€4,700	€4,230until 22 Feb	Select Download Brochure
LisbonScheduled	22 – 26 Mar 2027	€6,000	€5,400until 1 Mar	Select Download Brochure
LondonScheduled	29 Mar – 2 Apr 2027	€5,800	€5,220until 8 Mar	Select Download Brochure
MadridScheduled	5 – 9 Apr 2027	€6,000	€5,400until 15 Mar	Select Download Brochure
MakkahScheduled	12 – 16 Apr 2027	€4,800	€4,320until 22 Mar	Select Download Brochure
ManamaScheduled	12 – 16 Apr 2027	€5,300	€4,770until 22 Mar	Select Download Brochure
MarrakeshScheduled	19 – 23 Apr 2027	€4,700	€4,230until 29 Mar	Select Download Brochure
MilanScheduled	26 – 30 Apr 2027	€7,000	€6,300until 5 Apr	Select Download Brochure
GenevaScheduled	30 Aug – 3 Sept 2027	€7,300	€6,570until 9 Aug	✓ Selected Download Brochure

Available in: Istanbul · Dubai · London · Riyadh · Doha · Amsterdam

Related Courses

Threat Intelligence & Cyber Threat Management#2534

Cyber Threat Intelligence Training Course

Works through the intelligence lifecycle, from setting requirements and collecting sources to analysing threat actors and turning findings into defence.

5 Days·Classroom

View Course Request Brochure

Threat Intelligence & Cyber Threat Management#2536

Vulnerability Management & Patch Management Training Course

Sets up an end-to-end program to scan for vulnerabilities, rank them by risk and exploitability, and roll out patches through a controlled, tested process.

5 Days·Classroom

View Course Request Brochure

Threat Intelligence & Cyber Threat Management#2537

MITRE ATT&CK Framework for Cyber Defense Training Course

Uses MITRE ATT&CK tactics and techniques to map adversary activity, profile threats and find gaps in detection, hunting and incident response coverage.

5 Days·Classroom

View Course Request Brochure

Ready to Elevate Your Team's Capabilities?

Speak with our advisors about upcoming programmes or a bespoke corporate training plan.

Download Brochure Contact Our Team