Back to Learning Paths
Security Operations

Detection Engineer and Threat Hunter

Move from telemetry and adversary models into detection development, exposure prioritization, and proactive hunting.

FamilyDefensive Security Operations
LevelFoundational to intermediate
Courses13
Estimated time3.25-4.3 hours
Audience

Detection engineers, SOC analysts, Threat hunters

Outcome

Move from telemetry and adversary models into detection development, exposure prioritization, and proactive hunting.

Ordered sequence

Courses in this path

13 courses
Course 0110 modules
What Is Detection Engineering

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0210 modules
Telemetry Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 038 modules
SIEM

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 048 modules
EDR

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0510 modules
What Is Cyber Kill Chain

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0610 modules
Threat Intelligence Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0710 modules
Detection Engineering

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0810 modules
Writing Detection Rules

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 0910 modules
Detection Lifecycle Management

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 1010 modules
What Is Threat Hunting

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 1110 modules
Threat Hunting Fundamentals

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 128 modules
Threat Hunting

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Course 1310 modules
Known Exploited Vulnerabilities

Launch the canonical Truth Surge open course for this step in the path.

Launch Course
Related routes
Next steps
Defensive Security Operations
Digital Forensics and Incident Response

Establish an incident-response workflow and investigate evidence across desktop, mobile, browser, removable-media, and malware sources.

View Path
Defensive Security Operations
Cloud Security Operations

Operate cloud defenses across identity, containers, exposure management, resilience, and incident response.

View Path
Defensive Security Operations
OSINT Foundations

Develop a disciplined public-information investigation workflow from digital-footprint concepts through technical collection and verification.

View Path