Threat Hunting Fundamentals with Sentinel
Learn to proactively identify and mitigate security threats using foundational threat hunting techniques within Sentinel.
-
💬
AI instructor
Ask about any lesson and get a clear answer instantly, anytime. -
🕐
Start anytime
No schedules or deadlines — learn at your own pace, whenever suits you. -
🌐
In English
Lessons, tasks and certificate — all fully in your language.
About this course
Course contents
6 modules · 29 lessons · 3h 9m
1
Introduction to Proactive Defense
Understand the shift from reactive to proactive security and the core principles of threat hunting.
- What is Threat Hunting?
Introduction to the concept of proactively searching for threats rather than waiting for alerts.6 min - Foundational Cybersecurity Concepts
Review of essential security terms like logs, telemetry, and the attack lifecycle.7 min - The Importance of Proactive Defense
Why modern organizations cannot rely solely on automated detection systems.6 min - Modern Hunting Methodologies
Overview of structured hunting cycles like the SANS or TaHiTI models.7 min
2
The Hunter's Targets: Patterns and Tools
Identify what we are looking for and prepare the Microsoft Sentinel environment.
- Identifying Attack Patterns
Understanding Tactics, Techniques, and Procedures (TTPs) used by adversaries.7 min - Indicators of Compromise (IOCs)
Learning to recognize technical artifacts like IPs, hashes, and domain names.6 min - The Pyramid of Pain
Understanding why some indicators are harder for attackers to change than others.6 min - Introduction to Microsoft Sentinel
A high-level overview of Sentinel's architecture as a SIEM and SOAR.7 min - Setting Up Your Hunting Lab
Steps to configure a basic Sentinel workspace for practice.8 min
3
Strategy: Frameworks and Hypotheses
Learn to use MITRE ATT&CK and develop scientific hypotheses for hunts.
- Navigating MITRE ATT&CK
How to use the ATT&CK matrix to understand adversary behavior.7 min - Mapping Threats to the Matrix
Practical exercise in identifying which MITRE techniques apply to specific scenarios.7 min - Formulating a Hunting Hypothesis
Creating testable statements based on threat intelligence or observations.6 min - Structured Query Planning
Translating a human-readable hypothesis into a logical search plan.6 min - KQL Basics for Hunters
Introduction to Kusto Query Language, the engine behind Sentinel searches.8 min
4
Execution: Hunting in Sentinel
Hands-on data exploration and investigation using Sentinel's analytical tools.
- Sentinel Data Connectors
How to bring data into Sentinel from various sources for hunting.6 min - Data Exploration with Logs
Using the Logs blade to perform ad-hoc searches across datasets.7 min - Using Sentinel Hunting Queries
Leveraging built-in hunting templates to find common threats.7 min - Deep Dive Incident Investigation
Using the Investigation Graph to visualize relationships between entities.7 min - Entity Behavior (UEBA)
How to hunt for anomalies in user and device behavior.6 min - Filtering and Visualizing Results
Reducing noise and creating charts to spot trends in hunt data.6 min
5
Response and Automation
Interpret hunt results and streamline the response process.
- Interpreting Your Findings
Distinguishing between malicious activity, benign behavior, and false positives.7 min - Basic Automation Rules
Setting up simple triggers in Sentinel to handle recurring hunt outcomes.7 min - Introduction to Playbooks
Understanding how Logic Apps can automate complex response workflows.7 min - Integrating Hunts into Operations
How to turn a successful hunt into a permanent detection rule.6 min - The Feedback Loop
Using hunt results to improve overall security posture and data collection.6 min
6
Documentation and Reporting
Communicate the value of threat hunting to the organization.
- Documenting the Hunt Process
Recording steps, queries, and evidence for audit and collaboration.6 min - Reporting to Stakeholders
Translating technical findings into business risk and value.6 min - Measuring Hunt Success
Key performance indicators (KPIs) for a threat hunting program.6 min - Course Wrap-up
Summary of the journey and advice for continuous learning.5 min
The 'Hidden Breach' Hunt
You will be provided with a simulated dataset in Sentinel. Your task is to select a MITRE ATT&CK technique, develop a hypothesis, write a KQL query to find the activity, and document your findings.
What you'll get
-
📜
Certificate of completion
Add it to your LinkedIn profile -
💬
Personal AI tutor
Stuck on a lesson? Ask your built-in tutor anything, any time. -
🎧
Audio version included
Learn on the go — no screen needed -
♾️
Lifetime access
Come back anytime, no expiry -
📱
Phone or computer
Works anywhere, any device -
💸
14-day refund
No questions asked -
⚡
Short & focused
3h 9m of practical content
Certificate of completion
Every course you complete on PickAClass issues a credential like this — original, with its own code, verifiable by URL, and detailed about what was actually demonstrated.
Reviews
No reviews yet — be the first to share your experience.
Learners also took
Cybersecurity Foundations and Security+ SY0-701 Preparation
Cybersecurity Awareness and Identity Security Fundamentals
Cybersecurity Analyst: Modern Threat Defense and Response
Cybersecurity Awareness and Threat Defense for Employees
Frequently asked
What do I need to take this course? +
Just a phone or computer with internet. No installs, no special hardware.
How do I pay? +
By card via Stripe. We don’t store card details — Stripe handles them securely.
Can I get a refund? +
Yes — full refund within 14 days, no questions asked.
How long will I have access? +
Forever. Once you purchase, the course is yours to revisit anytime.
Will I get a certificate? +
Yes. On completion you'll receive a certificate you can add to your LinkedIn profile.
Get 10 courses a month
Members get 10 courses of their choice every month for CHF 0. No per-course charges — you pay only the subscription.
- ✓ 10 courses every month
- ✓ Cancel anytime
Renews monthly. Unused courses expire at the end of each billing month.