Syllabus

• Week 1

  Introduction to Industrial Threat Hunting

  • Lesson 1: Introduction to Entire Course

    An overview of how machine learning and data-driven techniques power modern threat hunting using Splunk and Jupyter.

  • Lesson 2: What is Threat Hunting?

    Threat hunting is a proactive, human-led approach to identifying hidden or undetected cyber threats by actively investigating suspicious behaviour beyond automated security tools.

  • Lesson 3: Hunting Methodologies

    An overview of key threat hunting methodologies and maturity models used to conduct structured, real-world hunts.

  • Lesson 4: ATT&CK and Hunt Matrix

    This lesson explains how the MITRE ATT&CK framework structures threat hunting by mapping adversary tactics and techniques to guide effective detection and response.

• Week 2

  Data Science for Cybersecurity

  • Lesson 5: Introduction to Data Science

    This lesson introduces data science and explains how it enables security teams to detect anomalies, predict threats, and turn raw logs into actionable intelligence.

  • Lesson 6: What is Feature Engineering in Threat Hunting

    This lesson explains how feature engineering transforms raw security logs into behavioural signals that improve machine learning–based threat detection.

  • Lesson 7: Security-Focused Visualisation Examples

    This section shows how security-focused visualisations reveal threats by highlighting anomalies and suspicious behaviour in security data.

• Week 3

  ML Algorithms for Threat Detection

  • Lesson 8: Unsupervised ML Basics

    This section introduces Isolation Forest, DBSCAN, and K-Means, explaining how each unsupervised algorithm detects anomalies in security data.

  • Lesson 9: Case Study: Suspicious Logins

    Practical case study on detecting suspicious logins

  • Lesson 10: Different use cases for ML-based Hunting

    This section covers key challenges and real-world use cases of ML-based threat hunting, highlighting both its strengths and limitations.

• Week 4

  Operationalising in Splunk and Jupyter

  • Lesson 11: Log Ingestion in Splunk

    This section explains indexing and field extraction in SIEMs and how they enable faster, more accurate threat hunting.

  • Lesson 12: Writing SPL for Data Preparation

    This section shows how to write SPL queries that clean, structure, and prepare log data for machine learning analysis.

  • Lesson 13: Splunk and Jupyter Integration

    This section explains how to integrate Splunk and Jupyter to combine SIEM data with advanced analytics for effective threat hunting.

  • Lesson 14: Course Wrap-up

    Additional resources and activities that reinforce key concepts and support learning across the entire course.

Who will you learn with?