{"permissions":{},"commerce":{"user_subscriptions":null,"subscription_plans":[],"global_tracking_code":"","conversion_tracking_code":"\n<script src="//platform.twitter.com/oct.js" type="text/javascript"></script>\n<script type="text/javascript">twttr.conversion.trackPid('nxgvm', { tw_sale_amount: 0, tw_order_quantity: 0 });</script>\n<noscript>\n<img height="1" width="1" style="display:none;" alt="" src="https://analytics.twitter.com/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n<img height="1" width="1" style="display:none;" alt="" src="//t.co/i/adsct?txn_id=nxgvm&p_id=Twitter&tw_sale_amount=0&tw_order_quantity=0" />\n</noscript>\n\n\n\n\n\n\n<script>\n gtag('event', 'conversion', {\n 'send_to': 'AW-779065575/jLMdCKTdhI8BEOexvvMC',\n 'transaction_id': ''\n });\n</script>","payment_requires_zip_code":false,"currency_code":"usd"},"media":{"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&ixlib=python-1.1.0&w=500&s=67714604a0a4dd036627a0b24d864157","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FHPn6zYkRHSqgbWxVJ237%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=250&ixlib=python-1.1.0&w=250&s=dd186d13312ece08824791a21b8f85ac","logo":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FwlZeWsU7RmexXY78HFKG%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&h=200&ixlib=python-1.1.0&w=600&s=3e88e4a65c1be65bf90a14c62bb9ddd8","url":"//d1do9mm1n6degf.cloudfront.net/","banners":[{"id":908,"school_id":5379,"background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FfJx85Y2NQeCeXz6Ou47r%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=0a17a1f2151f9c1fa92974d6a8410ff3","background_type":1,"background_overlay":"0,0,0,0.2","heading":"Applied Network Defense","subhead":"Information Security Training","readability":true,"button_text":"","button_func":"url","button_url":"","order":0,"image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FfJx85Y2NQeCeXz6Ou47r%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=0a17a1f2151f9c1fa92974d6a8410ff3","font_color":"ffffff","is_visible":true,"hide_for_subscription_plans":[],"show_for_subscription_plans":[]}],"theme":{"id":283,"name":"Applied Network Defense - 7600","description":"","primary_color":"0d71fb","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=cb76712ea91191b11d11e186e7c71b3d","heading_font":"","typekit_id":"","custom_css":"","theme_css_url":null,"typekit_scripts":null,"background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FB8TQJqo9RoOCyIQVKYNa%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=700&high=-80&ixlib=python-1.1.0&q=100&w=700&s=7a4e72884667a9e2ef8fba320516b46a","background_overlay":"0,0,0,0","background_type":1,"background_image_raw":"https://cdn.filestackcontent.com/B8TQJqo9RoOCyIQVKYNa"},"pages":[]},"school":{"id":5379,"name":"Applied Network Defense","platform_version":2.2,"url":"https://www.networkdefense.io/","is_ssl_disabled":false,"is_curriculum_licensor":false,"is_curriculum_subscriber":false,"is_activated":true,"is_activated_via_override":false,"resource_licensing_enabled":false,"trial_has_expired":false,"trial_days_remaining":null,"is_curriculum_enabled":true,"has_public_resources":true,"billing_model_display":"User (Pathwright 2)","billing_model":10,"website":"","has_certificate":true,"subdomain":"networkdefense","ietf_language_tag":"en-US","short_description":"Affordable, effective, online information security training. Made by analysts, for analysts.","has_consent_description":false},"support":{"has_faqs":false,"support_email":"chris@chrissanders.org","support_phone":"","support_link":"","support_policy":"

Course support is provided by e-mail. Most questions will be answered within 24 hours.

","support_faqs":null},"security":{"terms_of_service":"https://www.networkdefense.io/pages/terms-of-use.html","privacy_policy":"https://www.networkdefense.io/pages/privacy-policy.html","csrf_token":"FNeDBqGQVtUqaUGHZRAizZOengOADNCjD8DqsVQyRAtDb09U0NIcBa67cssbeih8","terms_agreement_prompt_override":""},"social":{"twitter_username":"","facebook_username":"","google_plus_username":"","pinterest_username":""},"integrations":{"facebook":null,"filepicker":{"read_policy":"eyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0=","read_signature":"888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34"},"algolia":false,"intercom":{"app_id":null,"school_app_id":null,"school_staff_app_id":null,"pathwright_app_id":"5txzvi2k","segment":false,"school_profile":null},"stripe":{"publishable_key":"pk_live_KFOuFb4HE2BpHFfGHilvfHmK"},"firebase":null,"google_analytics":{"account_id":"UA-92588624-1","domain_name":"pathwright.com"},"sso":{"pathwright_login_enabled":true,"providers":[],"current_provider":null}},"customizations":{"head_markup":["","\n\n\n\n"],"script_markup":["\n\n\n"],"global_tracking_code":""},"pathwright_account":{"is_on_legacy_plan":false,"is_activated":true,"payment_key":"pk_V26ZEKLGb9otX6E1CRSVns4V7Im9e","subscription":{"id":909,"school":5379,"plan":{"id":16,"name":"Essentials 2.0","image":null,"description":"For launching a full online school & community.","amount":99.0,"fee_per_additional_learner":0.0,"features":{"1-staff-member":true,"start-at-1000-active-learners":true,"sell-courses-with-commerce":true,"friendly-email-support":true,"starts-with-5-staff-members":true,"sell-subscriptions":true,"free-course-design-courses":true,"use-your-own-domain-name":true,"essential-app-integrations":true,"guided-course-design-courses":true,"priority-email-support":true,"create-unlimited-courses":true,"add-more-members-and-staff":true},"plan_order":2,"plan_color":"6bc288","visibility":15,"learners_included":1000,"user_discount_func":1,"should_contact_for_pricing":false,"intervals_by_month":[{"interval_id":5,"months":1,"amount_per_cycle":99.0,"amount_per_month":99.0,"discount_percent":0.0,"discounted_amount_per_month":99.0,"discounted_amount_per_cycle":99.0,"discount_per_month":0,"discount_per_cycle":0},{"interval_id":7,"months":6,"amount_per_cycle":594.0,"amount_per_month":99.0,"discount_percent":0.05,"discounted_amount_per_month":94.0,"discounted_amount_per_cycle":564.0,"discount_per_month":5,"discount_per_cycle":30},{"interval_id":10,"months":12,"amount_per_cycle":1188.0,"amount_per_month":99.0,"discount_percent":0.1,"discounted_amount_per_month":89.0,"discounted_amount_per_cycle":1068.0,"discount_per_month":10,"discount_per_cycle":120},{"interval_id":20,"months":1,"amount_per_cycle":99.0,"amount_per_month":99.0,"discount_percent":0.0,"discounted_amount_per_month":99.0,"discounted_amount_per_cycle":99.0,"discount_per_month":0,"discount_per_cycle":0}],"scholarships_available":false},"subscription":{"id":34550,"card_last_4":"1907","subscription_plan":{"id":84,"amount":0.0,"interval":5,"trial_period_days":0,"trial_type":null},"is_delinquent":false,"cycle_start_dtime":"2019-08-11T16:03:37-04:00","cycle_end_dtime":"2019-09-11T16:03:37-04:00","canceled_dtime":null,"provider_school_stripe_key":null,"trial_type":null,"trial_end_dtime":null,"paused_until_dtime":null,"is_canceled_at_cycle_end":false,"cancellation_reason":null},"interval":5,"additional_learners_included":0}},"user":null,"session":{"user":null,"school_membership":null,"csrf_token":"BTqXVDE3glwkEjFsrhkktTX17DEFQ8ZtzePKM8OLcs5xFp8Fsdsev4fUWPigrDEi","search":{"school_membership":{"key":"f6be8bd5d46f84c2ea84994f40163210b172c7791298971be392dd4724f39ad5","params":{"tagFilters":["school_5379"],"validUntil":1566213172,"restrictIndices":"prod_school_membership"}},"index_prefix":"prod_"},"firebase":null,"is_authenticated":false},"DEBUG":false,"resource":{"id":29861,"name":"Practical Threat Hunting","description":"

Practical Threat Hunting is a foundational course that will teach you how to approach threat hunting using a proven, structured, repeatable framework. I created this course to help people figure out what to hunt for, where to find it, and how to look for it.

Practical Threat Hunting is for you if

You’ve ever sat at a screen feeling paralyzed by not knowing what to look for next.
You’ve always wanted to be able to find evil on your network without alerts, but don’t know how to approach it.
You struggle to dissect attacks and derive hunting strategies from them.
You have a mountain of data at your disposal but don’t know which techniques are best suited for gaining the necessary perspective over it to spot anomalies.
You want to add threat hunting capabilities to your security team but don’t know how to get buy-in from management or prove just how valuable it can be.
You’re tired of being told hunting is as simple as “knowing what’s normal so you can spot evil” -- there’s more to it than that!

Practical Threat Hunting is the course that will teach you to hunt in a way that will never leave you at a shortage of places to start or techniques to manipulate data to spot anomalies. You’ll build skills through a series of expert-led lectures, scenario-based demonstrations, and hands-on lab exercises. Through a combination of theory and application, you’ll learn the basics of threat hunting and apply them to your network immediately.
You’ll learn:

Two hunting frameworks: Attack-Based Hunting (ABH) and Data-Based Hunting (DBH)
Techniques for leveraging threat intelligence and the MITRE ATT&CK framework for hunting input
The 9 most common types of anomalies you’ll encounter when reviewing evidence.
The 4 ways threat hunters most commonly transform data to spot anomalies
Typical staffing models for hunting capabilities in organizations of all sizes along with pros/cons
5 metrics that support and enable threat hunting operations
My two-step system for effective note taking while hunting (and how to transition those notes to longer-term storage for easy searching)
An ideal design for a hunter’s wiki/knowledgebase
A 5-step framework for dissecting and simulating attacks to prepare for hunting expeditions

You’ll also receive:

A list of my favorite hunting data sources and tools
A curated list of hunting expeditions to get you started
A list of my favorite Twitter follows for daily threat hunting input

Practical Threat Hunting will teach you how to become an effective threat hunter regardless of the toolset by focusing on the habits and techniques used by experts.

Practical Threat Hunting includes:

Over 15 hours of demonstration videos. These videos will break down the concepts and skills you need to become an effective threat hunter.
Hands-on labs to help you develop and test your skills. You’ll complete hunting labs using an ELK-based virtual machine we’ve loaded with log data representing several real-world scenarios. Not familiar with ELK? Don’t worry, I’ve provided a short primer video to get you started and you can also watch videos of me working through the labs. I’ve also provided all the raw log data so you can work with it on the command line, or import it into your analysis tool of choice.
Access to My Hunting Vault. I’ve compiled all the hunting expeditions mentioned in the course (along with several others) into PDF files you can use to reference as you’re hunting in your network. I’ve also included a wealth of additional information in PDF form, including a curated list of my favorite threat hunting tools and Twitter follows for hunting inspiration.
Membership in our exclusive students-only learning community. In our discourse-powered forum, you can ask questions, share hunting strategies, view community investigation playbooks, participate in our virtual reading group, learn about upcoming courses, network with other students, and communicate directly with AND course authors. I also post short blog entries here that don’t appear on my public blog.
Participation in our student charitable profit sharing program. A few times a year we designate a portion of our proceeds for charitable causes. AND students get to take part in nominating charities that are important to them to receive these donations.

Frequently Asked Questions:

Q: Is this course live?

This is NOT a live course. It’s an online video course you can take at your own pace.

Q: How long do I have access to the course material?
You have access to the course for six months following your purchase date. If you need more time, you can extend your access for a small monthly fee.

Q: Are there any prerequisites or lab requirements for this course?
This course is designed for all security practitioner skill levels and assumes no prior hunting experience. Some investigation experience is recommended (my Investigation Theory course is a good place to start there).

The lab data is provided in standalone JSON text files, or as part of a virtual machine running the ELK stack. If you want to use the VM, you’ll need to meet the following requirements:
- A virtualization platform such as VMWare or VirtualBox
- At least 4 GB of available RAM, although 6 is recommended for optimal performance.
- At least 15GB of available hard drive space.

Q: How much time does it take to do this course?
Given the amount of content and varying experience, it takes people dramatically different times to complete the material. There is about 15 hours of recorded video, plus the lab activities and individual exercises. Most choose to spread it out over several weeks as they take time to practice the concepts demonstrated.

Q: How many CPEs/CMUs is this course worth?
Organizations calculate continuing education credits in different ways, but they are often based on the length of the training. This course is approximately 15 hours of video content, plus the time you spend on the lab exercises. You’ll receive a certification of completion once you’ve finished the course.

Q: Do you offer discounts for groups from the same organization?
Bulk discounts are available for organizations that want to purchase multiple licenses for this Practical Threat Hunting training course. Please contact us to discuss payment and pricing.

","short_description":"A structured system to ensure you’re never at a loss for places and methods to start hunting for evil.","categories":[{"id":2727,"name":"Computer Security","slug":"computer-security","description":"","order":0,"resources_count":11},{"id":952,"name":"Information Technology","slug":"information-technology","description":null,"order":0,"resources_count":11}],"image":"","cover_image":"https://cdn.filestackcontent.com/7vnTy09jQpeOYHW0GS4W","thumb":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2F7vnTy09jQpeOYHW0GS4W%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=1&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=1785b11e0cf20815041990d90b173166","thumb_2x":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2F7vnTy09jQpeOYHW0GS4W%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?dpr=2&fit=crop&h=232&ixlib=python-1.1.0&w=310&s=fd870e7af5756ade1c11b9f8d7d713e2","icon":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2F7vnTy09jQpeOYHW0GS4W%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=35&ixlib=python-1.1.0&w=35&s=6f241bee7b99a9332bb12e1333855607","background_image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FXIjEu2eBSVm7vkIcqM2D%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=max&ixlib=python-1.1.0&w=1400&s=e30e8d75f9bd21744c9ce1ae879b7145","background_overlay":"0,0,0,0.2","background_image_blurred_cdn":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FXIjEu2eBSVm7vkIcqM2D%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?balph=40&blend=666666&blur=500&bm=screen&fit=max&fm=jpg&h=500&high=-80&ixlib=python-1.1.0&q=100&w=500&s=00ca3725d19b92886bcd53307e4d0de9","background_type":1,"authors":[{"id":771,"display_name":"Chris Sanders","first_name":"Chris","last_name":"Sanders","bio":"","image":"https://pathwright.imgix.net/https%3A%2F%2Fcdn.filestackcontent.com%2Fapi%2Ffile%2FJpBWM6TR6yHc0lz8Q1LQ%3Fsignature%3D888b9ea3eb997a4d59215bfbe2983c636df3c7da0ff8c6f85811ff74c8982e34%26policy%3DeyJjYWxsIjogWyJyZWFkIiwgInN0YXQiLCAiY29udmVydCJdLCAiZXhwaXJ5IjogNDYyMDM3NzAzMX0%253D?fit=crop&h=115&ixlib=python-1.1.0&w=115&s=08c599e53f9797ce19c27e6c1cd49d5f","resources_count":5,"salutation":"","title":"CEO at Applied Network Defense","slug":"chris-sanders","order":0,"avatar":"https://cdn.filestackcontent.com/JpBWM6TR6yHc0lz8Q1LQ"}],"created":"2017-10-11T17:01:29.362896-04:00","url":"https://www.networkdefense.io/library/threat-hunters-playbook/","offering_counts":{},"resource_type":10,"resource_type_display":"Course","slug":"threat-hunters-playbook","trailer_embed_code":"","list_order":null,"total_registration_count":200,"sum_registration_count":239,"lowest_public_offering_price":647.0,"highest_public_offering_price":647.0,"group_offering":null,"curriculum_offering":null,"num_offerings":4,"visibility_level_override":15,"licensing_enabled":false,"license_offerings":[],"licensed_from_resource":null,"certificate_generator_class":"CertificateGenerator","lowest_price_currency_display":"$647.00 USD","highest_price_currency_display":"$647.00 USD","discussion_enabled":true,"licensed_from_school":null},"offering":{"id":89442,"name":"Practical Threat Hunting - Public","access_starts":"2019-06-03T00:00:00-04:00","access_ends":null,"enrollment_starts":"2019-06-03T00:00:00-04:00","enrollment_ends":null,"description":"

Practical Threat Hunting is slated to open again in June 2019.

","visibility":15,"price":647.0,"seats":null,"seats_filled":0,"seats_available":-1,"price_for_user":647.0,"currency_display":"$647.00 USD","include_in_subscription_plans":[],"is_subscription_only":false,"resource_id":29861,"path_id":2737902,"permissions":{"can_participate":false,"can_register":true,"can_access":false,"can_edit":false,"can_edit_resource":false,"can_facilitate":false,"can_view_analytics":false,"can_invite_editor":false,"can_invite_teacher":false,"can_invite_moderator":false,"can_invite_student":false,"can_invite_observer":false},"due_dates_enabled":false,"is_group_offering":false,"step_counts":{"total":47,"reading":0,"video":36},"is_curriculum":false,"url":"/library/threat-hunters-playbook/89442/","invite_urls":{},"grade_report_url":null,"access":{"is_full":false,"has_registration_ended":false,"has_registration_started":true,"has_access_started":true,"has_access_ended":false},"analytics_visibility":5,"staff":[],"resource_license":null,"discussion_enabled":true,"parent_offering_id":null}}

Loading Practical Threat Hunting...