Threat Hunting
Threat Hunting Lab: Hypothesis Led Sweeps
Program narrative
You will run three guided hunts with seeded anomalies, then propose a fourth hunt plan from scratch. Coaching focuses on falsifiable statements and honest dead ends—celebrated, not hidden.
What is included
- Hypothesis one-pager template
- Evidence locker structure
- Peer red-team on your narrative
- Sweep timer discipline drills
- Handoff memo for incident command
Outcomes you can evidence
- Complete a time-boxed sweep with documented negatives
- Present findings without over-claiming attribution
- Reuse the hypothesis template on internal hunts
Course questions
No. We expect curiosity and patience with dead ends. Ego-heavy storytelling gets gently corrected.
Cohort voices
Dead ends were graded as thoughtfully as hits. That changed how I write internal hunt summaries.