Module 6: Operationalizing the Hunt
Turn hunting into a repeatable, measurable program. Document, automate, and prove value to leadership.
5 lessons · 3 labs
Path
- Lesson01
Threat Report to Hunt Hypothesis
Multi-phase intelligence reading. Entity decomposition. Evidence prediction. Turning a published threat advisory into a structured hunt plan.
- Lab02Intermediate
Lab 6.1 — Report Dissection Exercise
Given a simulated threat advisory, walk through the full decompose-predict-query pipeline. Produce a hunt plan document ready for execution.
- Lesson03
Documentation and Knowledge Management
Note-taking during hunts, organizing findings for reuse, building a team knowledge base. The Investigation Notebook System: fast notes during, slow review after.
- Lab04Advanced
Lab 6.2 — Hunt-to-Sigma Pipeline
Find a hunting result in the fresh data. Write a Sigma rule to detect it. Convert to Wazuh format using sigma-cli. Validate that it fires on the right events.
- Lesson05
Metrics and Executive Reporting
Proving hunt value to leadership. Tracking coverage improvements, data source ROI, and detection gap closure over time.
- Lesson06
Building a Hunt Program
Maturity levels from reactive (L0) to proactive (L4). Staffing models, cadence, automation boundaries, and the hunt-to-detect feedback loop.
- Lab07Expert
Lab 6.3 — Capstone: Full Campaign Hunt
Multi-scenario campaign hunt using all three fresh attack scenarios. Produce a complete hunt report: executive summary, timeline, IOCs, detection gaps, coverage recommendations, and Sigma rules.
- Lesson08
Hunt Program Maturity Assessment
Self-assessment exercise across 5 dimensions: data coverage, hypothesis quality, tool proficiency, documentation maturity, and organizational integration. Score your program and build a 90-day improvement plan.