Practical Threat Hunting

Write your awesome label here.

Introduction

Learn the foundational knowledge and practical skills required to perform effective threat hunting in real-world environments.
  • Level: Foundational to Intermediate
  • Study time: 16 hours
  • Lifetime course access
  • 1-year lab access
  • Certificate of completion

Course Description

Threat hunting is often treated as an advanced skill reserved for highly mature security teams. This course takes a practical approach by focusing on the core concepts, techniques, and workflows that allow you to hunt effectively in real environments.

This is a hands-on, technique-driven course that helps you move from raw security telemetry to meaningful, defensible conclusions. You will learn how to apply hunting techniques, enrich results with context, use temporal analysis, and hunt based on TTPs. You will also learn the foundational knowledge of Entra ID and Microsoft 365 required for threat hunting in these environments.

The course uses the same dataset as the Threat Hunting and Incident Response Case. As a bonus, after completing the course, you receive 30 days of access to the full case with 34 questions covering 15+ TTPs to continue practicing independently.

What You Will Learn

  • Leveraging AI for threat hunting
    (Spoiler: it’s not about writing queries with AI)
  • Fundamental threat hunting techniques
    Searching, stack counting, grouping
  • TTP-Based Threat Hunting
  • The most important skills in threat hunting & detection
    Contextual enrichment and temporal hunting models
  • Introduction to threat hunting in Entra ID and Microsoft 365
  • Documenting, tracking, and reporting hunt expeditions

Go from outdated and inefficient methods to modern techniques

Write your awesome label here.
Write your awesome label here.

Course Lessons

What our learners say

Perfect course for beginners that wants to start their Threat Hunting journey in KQL, leveraging Microsoft Defender XDR. Having access to a course, dataset and walkthroughs (if needed!) is a great way to learn for people that have an easier time learning by doing, rather than learning by reading or observing. This will also allow you to test out or experiment concepts you'll learn throughout the course, for different hunting scenarios.

I do recommend this course if you're just starting out your journey in Threat Hunting and want to learn about the different methodologies that can be leveraged, and how to leverage these in KQL.

Yoan Schinck, Cyber Response Manager | DFIR & Threat Hunting at KPMG-Egyde

I highly recommend the course "Practical Threat Hunting". Not only for beginners but also for seasoned practitioners who want to solidify their threat hunting skills. The fact that the course focuses heavily on methodology rather than tools makes it an excellent choice, no matter what query language you use for your hunts. I can’t wait for the Advanced course!

Paweł Mazur | Detection Engineer, Threat Hunter

Taught me so much about the basic principles of threat hunting. Irrespective of actual tools, which tbh my current employees are not MS Defender users, but the principles remain the same irrespective of the query or programming language used. And coming from a data background, I loved it!

Tara Powell

It's incredible how much knowledge is shared here. The queries are incredibly powerful and well-thought-out, and the way the knowledge is presented, along with the examples and so on, is simply perfect. Thank you.

Dennis Lohmann

Frequently asked questions

Who should take the course?

This course is ideal for:
  • Aspiring threat hunters
  • SOC analysts who want to move beyond alert triage
  • Red teamers who want to understand how they get detected
  • Security engineers transitioning into threat hunting

Are there any prerequisites?

A good understanding of the KQL language is required to follow the course and complete the hands-on labs. Familiarity with data manipulation, joins, and aggregation functions is expected.

Does the course contain video content?

No. While the course is text-based, the content is supported by screenshots with explanations. This approach makes it easy to follow and understand the content. You may check the free "Introduction to KQL for Security Analysis" course to see how it looks.

Are there any prerequisites or lab requirements?

No additional software and hardware is required. You will access the lab environment via a web browser. The lab environment is an Azure Data Explorer instance where you will analyze the logs of a simulated organization.

Can I get a certificate of completion?

Yes, you will receive a certificate of completion.

What is Lemon Squeezy?

Lemon Squeezy is a Merchant of Record that processes payments and handles taxes. You may see its name on your card statements. 

Build Real Threat Hunting Skills

Created by

Mehmet Ergene

Mehmet brings over 15 years of experience in cybersecurity, with a unique blend of expertise in KQL, threat hunting, detection engineering, and data science to his courses to help others advance their skills. Recognized four times as a Microsoft Security MVP, he is renowned for adapting the RITA beacon analyzer to KQL and for his insightful presentations at key conferences like the SANS DFIR Summit.