Skip to content
CertGPS
Skill

Threat Detection

Threat Detection is about identifying malicious activity in your environment before it causes damage. You'll monitor logs, analyze patterns, and hunt for threats.

Operations

Learning path

Start with SIEM basics, learn log analysis, practice threat hunting.

Career relevance

Core skill for SOC analysts, threat hunters, security analysts.

Practice projects

  • Write and test Sigma rules

    Write three Sigma rules for behavior you can reproduce in your lab, such as a new local admin account. Check that each fires on the attack and stays quiet otherwise.

    What you'll have: Tested detection rules with notes on false positives.

  • Map an incident to MITRE ATT&CK

    Take a published incident report, map each attacker step to an ATT&CK technique and note which log source would have caught it.

    What you'll have: A technique map that links attacker behavior to data sources.

Certifications teaching Threat Detection

Entry1

CompTIA

Entry

CompTIA Security+

Vendor-neutral proof of core security administration skills, tested partly through performance-based tasks and mapped by CompTIA to DoD 8140 work roles

Exam
$439
Study
3-6 months

Intermediate2

CompTIA

Intermediate

CompTIA Cybersecurity Analyst+

Tests a security analyst's ability to detect threats, prioritize vulnerabilities and handle incidents using real tool output, now on the CS0-004 exam

Exam
$439
Study
3-6 months

GIAC

Intermediate

GIAC Certified Incident Handler

Proves you can detect, contain and investigate attacks by understanding the tools behind them, with hands-on CyberLive tasks in live virtual machines

Exam
$999
Study
4-6 months

Expert1