OFFSEC TH-200: Foundational Threat Hunting
About This Course
This 5-day intensive course equips learners with the practical skills and knowledge required to proactively detect, monitor, investigate, and respond to cyber threats within enterprise environments. Through highly hands-on training and realistic scenarios, learners develop emerging skills in Detection and Monitoring Application by using industry-standard tools such as Splunk, CrowdStrike Falcon, and Suricata to identify network and endpoint Indicators of Compromise (IoCs), correlate security data, monitor suspicious behaviour, and support timely threat response.
The course also strengthens learners’ capabilities in Digital Forensics by guiding them to examine digital artefacts, interpret logs and endpoint evidence, investigate ransomware activity, assess attacker behaviour, and uncover compromised systems. By combining foundational threat hunting concepts with practical investigative methodologies, learners will be able to apply detection, monitoring, and forensic techniques to strengthen an organisation’s defensive security posture.
What You'll Learn
2. Analyse the threat actor landscape to identify potential risks, attack behaviours, and emerging threat patterns
3. Apply detection and monitoring techniques using network data, endpoint telemetry, and security logs
4. Use detection and monitoring applications such as Splunk, CrowdStrike Falcon, and Suricata to identify suspicious activity and Indicators of Compromise (IoCs)
5. Conduct endpoint-based threat hunting to detect malicious activity and uncover compromised systems
6. Apply digital forensics techniques to collect, examine, and interpret logs, endpoint artefacts, and other digital evidence
7. Investigate attacker behaviour, ransomware activity, credential misuse, and malicious user activity using forensic evidence
8. Explore advanced hunting techniques that go beyond Indicators of Compromise (IoCs) by analysing behaviours, patterns, and anomalies
9. Create structured threat hunting strategies that integrate detection, monitoring, and digital forensic practices for enterprise environments
Entry Requirements
At least 1 year of working experience in cybersecurity, security operations, network administration, system administration, IT operations, or related technology functions
Foundational understanding of networking, operating systems and cybersecurity concepts
Familiarity with security monitoring, incident response, SIEM platforms or log analysis will be advantageous
Ability to analyse technical information and investigate suspicious activities
Working proficiency in Microsoft Office applications (Word, Excel, PowerPoint)
Ability to speak, listen, read and write English at a proficiency level equivalent to the Employability Skills Workforce Skills Qualification (ES WSQ) Workplace Literacy (WPL) Level 6