Module 13: Threat Hunting — Find What Detections Miss
Don't wait for alerts. Go find the threats your detections missed.
6 lessons · 6 labs
Hunt for what detections missed — quieter movements from the same campaign.
Path
- Lesson01
Threat Hunting Fundamentals
PEAK framework, hypothesis-driven hunting, maturity model
- Lab02Intermediate
Lab 13.1 — SIEM Hunt: Authentication Anomalies
Hunt for auth anomalies in Wazuh without alert triggers.
- Lesson03
SIEM-Based Hunting with Wazuh
Lucene hunting queries, auth anomaly detection, log correlation
- Lab04Intermediate
Lab 13.2 — SIEM Hunt: Log Source Gap Analysis
Audit log coverage, identify blind spots, recommend improvements.
- Lesson05
Network Hunting with Suricata
Beaconing detection, DNS anomalies, traffic baselines
- Lab06Advanced
Lab 13.3 — Network Hunt: Beaconing Detection
Detect C2 beaconing patterns in EveBox network data.
- Lesson07
Endpoint Hunting with VQL
Stacking, frequency analysis, fleet hunts, Hunt Manager
- Lab08Advanced
Lab 13.4 — Endpoint Hunt: Hypothesis Hunt
Intel-driven VQL hunt across the fleet for APT persistence.
- Lesson09
Cross-Tool Correlation Hunting
The hunting triangle: SIEM + endpoint + network evidence
- Lab10Expert
Lab 13.5 — Endpoint Hunt: Fleet Stacking
Baseline fleet with 5-category VQL stacking, find outliers.
- Lesson11
Building a Hunt Program
Cadence, playbooks, hunt-to-detection pipeline, metrics
- Lab12Expert
Lab 13.6 — Cross-Tool Campaign Hunt
Hunt a multi-stage intrusion across SIEM data. Capstone hunt.