← detection engineer
Take Quiz →
Threat Hunting — PEAK, TaHiTI, Hypothesis to Evidence
advanced 5h
Run a PEAK-framework hunt end-to-end — hypothesis, data, search, finding, and detection back-pressure.
After this module you will
- › Distinguish reactive detection from proactive hunting
- › Apply the PEAK framework (Prepare, Execute, Act with Knowledge)
- › Structure a hunt using the TaHiTI methodology
- › Generate hypotheses from CTI, anomalies, and baseline drift
- › Convert a high-confidence hunt finding into a new Sigma rule
Lessons
1 Detection vs Hunting — When Rules Aren't Enough
20 min 2 PEAK Framework — Prepare, Execute, Act with Knowledge
25 min 3 Hypothesis Generation — Three Sources of Hunt Ideas
25 min 4 TaHiTI — Structured Hunt Documentation
25 min 5 Hunt-to-Detection Pipeline — Converting Findings into Rules
25 min Module Quiz
Test your knowledge before moving on.