FOR668: Threat Hunting and Data Analysis

Students need an x86_64 laptop capable of running VMware Workstation or VMware Fusion. The course VM is Linux-based with SOF-ELK pre-installed and configured, datasets already ingested, and ES|QL support. Allocate 2 vCPUs and 8 GB RAM to the VM. A laptop with at least 16 GB RAM and 225 GB of free disk space is recommended. In-person classes require Internet access.

If you have additional questions about the laptop specifications, please contact customer service.

• Threat hunters expanding their data analysis and program-impact skills
• Detection engineers turning human-led hunts into automated detection
• SOC analysts moving beyond alert triage into proactive hunting
• Incident responders looking to proactively uncover attacker activity
• CTI analysts translating intelligence into actionable hunts
• Red teamers and penetration testers seeking to understand detection gaps

• Course VM with SOF-ELK and the required datasets pre-loaded
• Realistic host and network data for hands-on hunting exercises
• Practice using ES|QL for searching and analyzing security data
• Hands-on experience with hypothesis and baseline hunting methods
• Practical experience using AI as a supervised hunting assistant

A basic knowledge of how IT systems work is required. Prior threat hunting experience is helpful but not required. Splunk experience, previous host- or network-based DFIR training such as FOR508 or FOR572, and prior use of ChatGPT or a similar system may help, but none are mandatory.

FOR668 fits within the SANS DFIR curriculum as a dedicated threat hunting and data analysis course. Related and follow-on courses identified in the proposal include FOR508, FOR572, FOR608, FOR577, and a proposed follow-on course in model-assisted threat hunting.

Threat hunting is a proactive security practice that uses data and analysis to identify malicious behavior that automated detection systems may have missed. A mature hunting program can do more than uncover incidents: it can expose detection gaps, improve security controls, generate better detections, and help teams continuously strengthen their defenses.

FOR668 builds practical skills for roles that need to investigate security data proactively rather than rely only on alerts. You will practice structuring hunts, analyzing multiple data sources, finding anomalies, communicating results, improving detections, and using AI responsibly as an assistant. These skills can support growth in threat hunting, detection engineering, SOC, incident response, CTI, and related DFIR roles.