Free Threat Hunter Roadmap
The defender who goes looking. Security+, SOC fundamentals and CySA+ first, then packet analysis, hunting in the SIEM and EDR, intelligence and ATT&CK, and the scripting that scales a hunt.
7 steps · 43 free videos · 6 free reads
Create your free account to open all 2,396 free items
The 49 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.
Before you start
Read these first
The free roadmap
7 steps, in order
The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.
Start here →
Step 1 — Security foundation
The baseline every SOC hires for.
Follow the free CompTIA Security+ (SY0-701) roadmap.
🔒 The full roadmap adds here: 6 full courses · hands-on labs 1–148 of 345 (courses in Membership · 71 labs in Membership · 77 labs in Infrastructure Labs)
- Course · CompTIA Security+ Certification (SY0-701): The Total Course · 🔒 Membership
- Course · Security+ (SY0-701) - Self-paced Course! · 🔒 Membership
- Course · CompTIA Security+ SY0-701: General Security Concepts · 🔒 Membership
- Course · CompTIA Security+: Viruses, Threats and Compromise Indicators · 🔒 Membership
- Course · CompTIA Security+ Labs · 🔒 Membership
- Course · Security+ Just Labs: The Ultimate Hands-On Bootcamp · 🔒 Membership
- Lab 1 of 345 · Additional Scanning Options · 🔒 Membership
- Lab 2 of 345 · Basics of Metasploit · 🔒 Membership
- Lab 3 of 345 · BCP DRP and Test Planning · 🔒 Membership
- Lab 4 of 345 · BitLocker Setup · 🔒 Membership
- Lab 5 of 345 · Block Incoming Traffic on Known Port · 🔒 Membership
- Lab 6 of 345 · Comparing Controls · 🔒 Membership
- Lab 7 of 345 · Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 Server · 🔒 Membership
- Lab 8 of 345 · Creation of BCP and DRP · 🔒 Membership
- Lab 9 of 345 · Data Backup to Prep for Recovery · 🔒 Membership
- Lab 10 of 345 · Event Log · 🔒 Membership
- Lab 11 of 345 · Host Data Integrity Baselining · 🔒 Membership
- Lab 12 of 345 · Installing Patches and Testing Software · 🔒 Membership
- Lab 13 of 345 · MITRE - Attack · 🔒 Membership
- Lab 14 of 345 · MITRE - Defend · 🔒 Membership
- Lab 15 of 345 · Network Discovery · 🔒 Membership
- Lab 16 of 345 · Network Segmentation (FW/DMZ/WAN/LAN) · 🔒 Membership
- Lab 17 of 345 · Network Topology Generation · 🔒 Membership
- Lab 18 of 345 · Open Source Collection · 🔒 Membership
- Lab 19 of 345 · Open Source Password Cracking · 🔒 Membership
- Lab 20 of 345 · Scanning From Windows · 🔒 Membership
- Lab 21 of 345 · Windows Event Log Manipulation via Windows Event Viewer · 🔒 Membership
- Lab 22 of 345 · Wireshark · 🔒 Membership
- Lab 23 of 345 · Manage Users and Groups in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 24 of 345 · Manage Users and Groups in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 25 of 345 · Can You Manage Users and Groups in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 26 of 345 · Configure Password Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 27 of 345 · Configure Password Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 28 of 345 · Can You Manage Password Requirements in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 29 of 345 · Configure Standard Linux Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 30 of 345 · Configure Standard Windows Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 31 of 345 · Can You Configure Standard Linux and Windows Permissions? [Advanced] · 🔒 Infrastructure Labs
- Lab 32 of 345 · Can You Manage Access in Linux and Windows? [Expert] · 🔒 Infrastructure Labs
- Lab 33 of 345 · Can You Harden the SSH Service on a Linux Server? [Advanced} · 🔒 Infrastructure Labs
- Lab 34 of 345 · Force Users to Change Password Upon First Sign In [Guided] · 🔒 Infrastructure Labs
- Lab 35 of 345 · Remove a User Account [Guided] · 🔒 Infrastructure Labs
- Lab 36 of 345 · Can You Add Server Access for a Group? [Advanced] · 🔒 Infrastructure Labs
- Lab 37 of 345 · Examine Log Files to Block Bad Actors [Guided] · 🔒 Infrastructure Labs
- Lab 38 of 345 · Harden a Server by Limiting Access to a Single Subnet [Guided] · 🔒 Infrastructure Labs
- Lab 39 of 345 · Can You Harden a Server by Restricting Access per Protocol? [Advanced] · 🔒 Infrastructure Labs
- Lab 40 of 345 · Can You Harden a Linux Web Server? [Expert] · 🔒 Infrastructure Labs
- Lab 41 of 345 · Deploy a Private Certificate Authority [Guided] · 🔒 Infrastructure Labs
- Lab 42 of 345 · Configure Custom Certificate Templates and Deployment Options [Guided] · 🔒 Infrastructure Labs
- Lab 43 of 345 · Manually Request a PKI Certificate [Guided] · 🔒 Infrastructure Labs
- Lab 44 of 345 · Can You Deploy a Certificate Authority and Issue Certificates? [Advanced] · 🔒 Infrastructure Labs
- Lab 45 of 345 · Enable DNSSEC [Guided] · 🔒 Infrastructure Labs
- Lab 46 of 345 · Use EFS To Encrypt Files on NTFS Volumes [Guided] · 🔒 Infrastructure Labs
- Lab 47 of 345 · Can You Secure DNS Resource Records and Windows NTFS Volume File Objects? [Advanced] · 🔒 Infrastructure Labs
- Lab 48 of 345 · Enable SSL/TLS on a Website [Guided] · 🔒 Infrastructure Labs
- Lab 49 of 345 · Enable Client SSL/TLS [Guided] · 🔒 Infrastructure Labs
- Lab 50 of 345 · Can You Secure a Website with an SSL/TLS Certificate? [Advanced] · 🔒 Infrastructure Labs
- Lab 51 of 345 · Can You Use PKI to Secure a Network Environment? [Expert] · 🔒 Infrastructure Labs
- Lab 52 of 345 · Cryptography: Attacking Classic Ciphers · 🔒 Membership
- Lab 53 of 345 · Cryptography: Breaking Repeated Key XOR Cipher · 🔒 Membership
- Lab 54 of 345 · Cryptography: Breaking Weak RSA Keys · 🔒 Membership
- Lab 55 of 345 · Cryptography: Decrypting Files With a Dictionary Attack · 🔒 Membership
- Lab 56 of 345 · Cryptography: Forging Digital Signatures · 🔒 Membership
- Lab 57 of 345 · Cryptography: Forging MACs With Side Channels · 🔒 Membership
- Lab 58 of 345 · Cryptography: Hidden Veracrypt Containers · 🔒 Membership
- Lab 59 of 345 · Cryptography: Man In the Middle Attack · 🔒 Membership
- Lab 60 of 345 · Cryptography: Password Cracking · 🔒 Membership
- Lab 61 of 345 · Cryptography: Setting Up HTTPS in Windows and Linux · 🔒 Membership
- Lab 62 of 345 · Cryptography: Setting Up Two Factor Authentication · 🔒 Membership
- Lab 63 of 345 · Cryptography: Steganography · 🔒 Membership
- Lab 64 of 345 · Cryptography: Using GPG for Encryption and Key Management · 🔒 Membership
- Lab 65 of 345 · Cryptography: Using the OpenSSL CLI Tool · 🔒 Membership
- Lab 66 of 345 · Getting Started with Security Concepts in Windows and Linux Environments [Getting Started] · 🔒 Infrastructure Labs
- Lab 67 of 345 · Configure Windows Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 68 of 345 · Configure Linux Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 69 of 345 · Configure Security Settings by Using Microsoft Group Policy [Guided] · 🔒 Infrastructure Labs
- Lab 70 of 345 · Identify Non-secure Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 71 of 345 · Can You Secure Host Settings Through Firewall Settings and Group Policy? [Advanced] · 🔒 Infrastructure Labs
- Lab 72 of 345 · Configure IPSec [Guided] · 🔒 Infrastructure Labs
- Lab 73 of 345 · Configure a Windows PPTP VPN [Guided] · 🔒 Infrastructure Labs
- Lab 74 of 345 · Can You Secure Network Access? [Advanced] · 🔒 Infrastructure Labs
- Lab 75 of 345 · Can You Harden Windows Hosts? [Expert] · 🔒 Infrastructure Labs
- Lab 76 of 345 · Back Up and Restore Data in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 77 of 345 · Back Up and Restore Data in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 78 of 345 · Can You Back Up and Restore Data in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 79 of 345 · Configure and Test the Firewall in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 80 of 345 · Configure and Test the Firewall in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 81 of 345 · Can You Configure the Firewall in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 82 of 345 · Configure Patch Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 83 of 345 · Configure Update Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 84 of 345 · Can You Configure Update Management in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 85 of 345 · Can You Manage Windows and Linux Systems? [Expert] · 🔒 Infrastructure Labs
- Lab 86 of 345 · Applying Filters to TCPDump and Wireshark · 🔒 Membership
- Lab 87 of 345 · DNS as a Remote Shell · 🔒 Membership
- Lab 88 of 345 · Firewall Setup and Configuration · 🔒 Membership
- Lab 89 of 345 · Gap Analysis of Firewall Rules · 🔒 Membership
- Lab 90 of 345 · Implementing Least-Privilege on Windows · 🔒 Membership
- Lab 91 of 345 · Setting Up Zones in a Firewall · 🔒 Membership
- Lab 92 of 345 · Snorby Setup and Operation · 🔒 Membership
- Lab 93 of 345 · TCPDump · 🔒 Membership
- Lab 94 of 345 · Tweaking Firewall Rules for Detection · 🔒 Membership
- Lab 95 of 345 · Using Snort and Wireshark to Analyze Traffic · 🔒 Membership
- Lab 96 of 345 · Getting Started with Cybersecurity Defensive Tools [Getting Started] · 🔒 Infrastructure Labs
- Lab 97 of 345 · Managing Log Files on a Windows Server [Guided] · 🔒 Infrastructure Labs
- Lab 98 of 345 · Configure Windows Defender on a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 99 of 345 · Configure a Local Security Policy on Server 2016 [Guided] · 🔒 Infrastructure Labs
- Lab 100 of 345 · Can You Use the Sysinternals Suite to Review Permissions on a Windows System? [Advanced] · 🔒 Infrastructure Labs
- Lab 101 of 345 · Using Encryption to Secure Information [Guided] · 🔒 Infrastructure Labs
- Lab 102 of 345 · Can You Configure Drive Encryption by Using LUKS and BitLocker? [Advanced] · 🔒 Infrastructure Labs
- Lab 103 of 345 · Can You Configure Remote Administration by Using PuTTY and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 104 of 345 · Use a Password Cracking Utility in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 105 of 345 · Can You Use PowerShell to Gather Computer Information in Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 106 of 345 · Escalate Privileges in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 107 of 345 · Can You Enumerate Network Services by Using Port Scanning in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 108 of 345 · Auditing Service Accounts and Setting Up Automated Log Collection · 🔒 Membership
- Lab 109 of 345 · Centralized Monitoring · 🔒 Membership
- Lab 110 of 345 · CIRP Creation and Disaster · 🔒 Membership
- Lab 111 of 345 · Creation of Standard Operating Procedures for Recovery · 🔒 Membership
- Lab 112 of 345 · Data Downloads and Validation · 🔒 Membership
- Lab 113 of 345 · Force Point: DLP Email Overview · 🔒 Membership
- Lab 114 of 345 · Force Point: DLP Network Overview · 🔒 Membership
- Lab 115 of 345 · Identifying Key Assets · 🔒 Membership
- Lab 116 of 345 · Leveraging Internal Intelligence Resources · 🔒 Membership
- Lab 117 of 345 · Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 118 of 345 · Monitoring and Verifying Management Systems · 🔒 Membership
- Lab 119 of 345 · Open and Close Ports on Windows 7 · 🔒 Membership
- Lab 120 of 345 · Phishing · 🔒 Membership
- Lab 121 of 345 · Post Incident Service Restoration · 🔒 Membership
- Lab 122 of 345 · Ransomware · 🔒 Membership
- Lab 123 of 345 · Recover from SQL Injection Attack · 🔒 Membership
- Lab 124 of 345 · Sensitive Information Identification · 🔒 Membership
- Lab 125 of 345 · Vulnerability Identification and Remediation · 🔒 Membership
- Lab 126 of 345 · Use Git to Manage Code [Guided] · 🔒 Infrastructure Labs
- Lab 127 of 345 · Analyze Log Files for Malicious Activity [Guided] · 🔒 Infrastructure Labs
- Lab 128 of 345 · Identify and Manage Old Software [Guided] · 🔒 Infrastructure Labs
- Lab 129 of 345 · Deploy a Docker Container [Guided] · 🔒 Infrastructure Labs
- Lab 130 of 345 · Deploy a Virtual Machine [Guided] · 🔒 Infrastructure Labs
- Lab 131 of 345 · Configure a Jump Box [Guided] · 🔒 Infrastructure Labs
- Lab 132 of 345 · Manage File Redundancy for Resilience and Recovery [Guided] · 🔒 Infrastructure Labs
- Lab 133 of 345 · Manage System Restore Using Windows 11 [Guided] · 🔒 Infrastructure Labs
- Lab 134 of 345 · Use Alerting and Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 135 of 345 · Digitally Sign Code To Verify Authenticity [Guided] · 🔒 Infrastructure Labs
- Lab 136 of 345 · Configure a Wireless Access Point [Guided] · 🔒 Infrastructure Labs
- Lab 137 of 345 · Sanitize Storage Disks [Guided] · 🔒 Infrastructure Labs
- Lab 138 of 345 · Enhance Security by Using SELinux [Guided] · 🔒 Infrastructure Labs
- Lab 139 of 345 · Manage Configurations by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 140 of 345 · Configure Devices by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 141 of 345 · Perform Security Audits on Linux Services [Guided] · 🔒 Infrastructure Labs
- Lab 142 of 345 · Baseline Systems in Accordance with Policy Documentation · 🔒 Membership
- Lab 143 of 345 · Conduct Baseline Comparison for Indicators of Compromise · 🔒 Membership
- Lab 144 of 345 · Creating a Baseline Using Autopsy · 🔒 Membership
- Lab 145 of 345 · Creating a Secondary Baseline and Conducting Comparison · 🔒 Membership
- Lab 146 of 345 · Manually Creating a Baseline with MD5Deep · 🔒 Membership
- Lab 147 of 345 · Recovering Data and Data Integrity Checks · 🔒 Membership
- Lab 148 of 345 · Windows Deployment Services · 🔒 Membership
Try a free SOC lab: Shut the door (~4 min) → A scripted simulation in your browser. No account needed.
Step 2 — SOC foundations
Know what a security operations centre does all day before you hunt in one. Skip it if you've done the SOC Analyst path.
🔒 The full roadmap adds here: 2 full courses · hands-on labs 149–163 of 345 (courses in Membership · 15 labs in Infrastructure Labs)
- Course · Blue Team Boot Camp: Defending Against Hackers · 🔒 Membership
- Course · SOC for Blue Teams · 🔒 Membership
- Lab 149 of 345 · Enforce Segmentation and Approved Access Paths [Guided] · 🔒 Infrastructure Labs
- Lab 150 of 345 · Harden a JumpBox for Secure Administration [Guided] · 🔒 Infrastructure Labs
- Lab 151 of 345 · Secure Privileged Access and Auditing in Active Directory [Guided] · 🔒 Infrastructure Labs
- Lab 152 of 345 · Establish a Windows Hardening and Security Logging Baseline [Guided] · 🔒 Infrastructure Labs
- Lab 153 of 345 · Reduce DVWA Exposure by Using Compensating Controls [Guided] · 🔒 Infrastructure Labs
- Lab 154 of 345 · Implement TLS and Certificate Controls for a Service [Guided] · 🔒 Infrastructure Labs
- Lab 155 of 345 · Integrated Hardening Sprint A: Segment, Harden, and Secure Services [Advanced] · 🔒 Infrastructure Labs
- Lab 156 of 345 · Governance and Compliance Evidence Collection [Guided] · 🔒 Infrastructure Labs
- Lab 157 of 345 · Prioritize Risks and Implement One Remediation [Guided] · 🔒 Infrastructure Labs
- Lab 158 of 345 · Threat Modeling to Controls: Identify Risks and Implement Mitigations [Guided] · 🔒 Infrastructure Labs
- Lab 159 of 345 · Establish centralized logging by onboarding hosts and validating monitoring readiness [Guided] · 🔒 Infrastructure Labs
- Lab 160 of 345 · Hunt Threats Using Intelligence and Rule-Based Detection [Guided] · 🔒 Infrastructure Labs
- Lab 161 of 345 · Triage, Contain, and Automate Incident Response [Guided] · 🔒 Infrastructure Labs
- Lab 162 of 345 · Govern, Detect, Hunt, and Respond Through an Integrated Security Operations Sprint [Advanced] · 🔒 Infrastructure Labs
- Lab 163 of 345 · Design, Defend, and Respond Across an End-to-End Security Architecture [Expert] · 🔒 Infrastructure Labs
Step 3 — The analyst certification
The SOC analyst's certification, with its intelligence, SIEM and incident-response labs — hunters hold it before they hunt.
Follow the free CompTIA CySA+ (CS0-004) roadmap.
🔒 The full roadmap adds here: 2 full courses · hands-on labs 164–306 of 345 (courses in Membership · 80 labs in Membership · 63 labs in Infrastructure Labs)
- Course · TOTAL: CompTIA CySA+ Cybersecurity Analyst (CS0-004) · 🔒 Membership
- Course · CompTIA CySA+ Labs · 🔒 Membership
- Lab 164 of 345 · Analyze Various Data Sources to Confirm Suspected Infection · 🔒 Membership
- Lab 165 of 345 · Assessing Vulnerabilities Post Addressal · 🔒 Membership
- Lab 166 of 345 · BitCoin Mining Web Application on Corporate Network · 🔒 Membership
- Lab 167 of 345 · Check for Indicators of Other Attack Activity (Debug PE File) · 🔒 Membership
- Lab 168 of 345 · Cyber Security Evaluation Tool (CSET) · 🔒 Membership
- Lab 169 of 345 · Entering Information into a CMDB · 🔒 Membership
- Lab 170 of 345 · Event Logs with Autopsy · 🔒 Membership
- Lab 171 of 345 · Internet History · 🔒 Membership
- Lab 172 of 345 · Nexpose: Red Team Exploitation · 🔒 Membership
- Lab 173 of 345 · Overview of Kibana · 🔒 Membership
- Lab 174 of 345 · Performing an Initial Attack Analysis · 🔒 Membership
- Lab 175 of 345 · Preparing Target Media · 🔒 Membership
- Lab 176 of 345 · Recover from Illegal Bitcoin Mining Incident · 🔒 Membership
- Lab 177 of 345 · Recover from Web-Based Flashpack Incident · 🔒 Membership
- Lab 178 of 345 · Report Writing for Presentation to Management · 🔒 Membership
- Lab 179 of 345 · Respond to and Validate Alerts from Antivirus Software · 🔒 Membership
- Lab 180 of 345 · WMI Event Persistence · 🔒 Membership
- Lab 181 of 345 · Comprehensive Threat Response · 🔒 Membership
- Lab 182 of 345 · Conduct Supplemental Monitoring · 🔒 Membership
- Lab 183 of 345 · Create Custom Snort Rules · 🔒 Membership
- Lab 184 of 345 · Monitoring for False Positives · 🔒 Membership
- Lab 185 of 345 · Monitoring Network Traffic · 🔒 Membership
- Lab 186 of 345 · Monitoring Network Traffic for Potential IOA/IOC · 🔒 Membership
- Lab 187 of 345 · SNORT Configuration and Operation Lab · 🔒 Membership
- Lab 188 of 345 · Perform Network Scanning [Guided] · 🔒 Infrastructure Labs
- Lab 189 of 345 · Use SSH for Remote Access [Guided] · 🔒 Infrastructure Labs
- Lab 190 of 345 · Use Wireshark Filters to Explore Captured Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 191 of 345 · Perform Application Source Code Verification [Guided] · 🔒 Infrastructure Labs
- Lab 192 of 345 · Perform Log Analysis [Guided] · 🔒 Infrastructure Labs
- Lab 193 of 345 · Find Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 194 of 345 · Assess Cybersecurity Templates and Benchmarks [Guided] · 🔒 Infrastructure Labs
- Lab 195 of 345 · Can You Discover Vulnerabilities Over a Network? [Advanced] · 🔒 Infrastructure Labs
- Lab 196 of 345 · Can You Establish Secure Communications by Using SSH and Wireshark? [Advanced] · 🔒 Infrastructure Labs
- Lab 197 of 345 · Can You Manage Threats by Using Source Code, Logs, and Security Templates? [Advanced] · 🔒 Infrastructure Labs
- Lab 198 of 345 · Can You Reduce Threats by Using Nmap, SSH, Source Code Analysis, and Security Templates? [Expert] · 🔒 Infrastructure Labs
- Lab 199 of 345 · Utilize Network Analysis Tools [Guided] · 🔒 Infrastructure Labs
- Lab 200 of 345 · Use Security Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 201 of 345 · Perform Email Header Analysis [Guided] · 🔒 Infrastructure Labs
- Lab 202 of 345 · Evaluate Network Logging [Guided] · 🔒 Infrastructure Labs
- Lab 203 of 345 · Display Files by Performing Forensic Analysis Tasks [Guided] · 🔒 Infrastructure Labs
- Lab 204 of 345 · Evaluate the Output of Enumeration Tools [Guided] · 🔒 Infrastructure Labs
- Lab 205 of 345 · Evaluate Credential Security [Guided] · 🔒 Infrastructure Labs
- Lab 206 of 345 · Can You Capture and Analyze Network Traffic and Logging by Performing Management Tasks? [Advanced] · 🔒 Infrastructure Labs
- Lab 207 of 345 · Can You Evaluate Account Security Threats? [Advanced] · 🔒 Infrastructure Labs
- Lab 208 of 345 · Can You Perform Forensic Analysis Tasks to Display Files? [Advanced] · 🔒 Infrastructure Labs
- Lab 209 of 345 · Can You Capture and Analyze Network Traffic? [Expert] · 🔒 Infrastructure Labs
- Lab 210 of 345 · Event Log Collection with QRadar · 🔒 Membership
- Lab 211 of 345 · QRADAR - Auditing Service Accounts and Generating SIEM Reports · 🔒 Membership
- Lab 212 of 345 · QRadar - Centralized Monitoring · 🔒 Membership
- Lab 213 of 345 · QRADAR - Collecting Logs and Verifying Syslog Aggregation with pfSense · 🔒 Membership
- Lab 214 of 345 · QRadar - IDS Setup and Configuration · 🔒 Membership
- Lab 215 of 345 · QRadar - Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 216 of 345 · QRadar - Log Correlation & Analysis to Identify Potential IOC with Custom Log Types · 🔒 Membership
- Lab 217 of 345 · QRADAR - Setting Up SYSLOG Forwarding From a Windows System · 🔒 Membership
- Lab 218 of 345 · QRadar - Snort Signatures, IDS Tuning, and Blocking · 🔒 Membership
- Lab 219 of 345 · Perform Network Scanning and Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 220 of 345 · Implement Intrusion Detection by Using Wazuh [Guided] · 🔒 Infrastructure Labs
- Lab 221 of 345 · Configure and Manage SSH to Establish Secure Connections [Guided] · 🔒 Infrastructure Labs
- Lab 222 of 345 · Manage Incidents by Using Incident Response Tools [Guided] · 🔒 Infrastructure Labs
- Lab 223 of 345 · Configure Secure HTTP Services [Guided] · 🔒 Infrastructure Labs
- Lab 224 of 345 · Configuring VPN Services [Guided] · 🔒 Infrastructure Labs
- Lab 225 of 345 · Can You Improve Security by Using Network Scanning, Sniffing, and GPOs? [Advanced] · 🔒 Infrastructure Labs
- Lab 226 of 345 · Can You Implement Intrusion Detection by Using Wazuh? [Advanced] · 🔒 Infrastructure Labs
- Lab 227 of 345 · Can You Improve Network Security with SSH, HTTPS, and IPSec? [Advanced] · 🔒 Infrastructure Labs
- Lab 228 of 345 · Can You Use Snort and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 229 of 345 · Analyze and Update a Company BCP/BIA/DRP/CIRP · 🔒 Membership
- Lab 230 of 345 · Analyze SQL Injection Attack · 🔒 Membership
- Lab 231 of 345 · Conduct Log Analysis and Cross Examination for False Positives · 🔒 Membership
- Lab 232 of 345 · Core Impact Web Application Penetration Testing · 🔒 Membership
- Lab 233 of 345 · Creating Recommendations Based on Vulnerability Assessments · 🔒 Membership
- Lab 234 of 345 · Identify Whether High-Risk Systems Were Affected · 🔒 Membership
- Lab 235 of 345 · Identifying System Vulnerabilities with OpenVAS · 🔒 Membership
- Lab 236 of 345 · Manual Vulnerability Assessment · 🔒 Membership
- Lab 237 of 345 · Penetration Tester Challenge · 🔒 Membership
- Lab 238 of 345 · Phishing · 🔒 Membership
- Lab 239 of 345 · Preliminary Scanning · 🔒 Membership
- Lab 240 of 345 · Threat Designation · 🔒 Membership
- Lab 241 of 345 · Vulnerability Proof of Concept and Remediation · 🔒 Membership
- Lab 242 of 345 · Vulnerability Scanning with GVM · 🔒 Membership
- Lab 243 of 345 · Windows System Hardening with Group Policy & Active Directory · 🔒 Membership
- Lab 244 of 345 · Windows System Hardening with PowerShell · 🔒 Membership
- Lab 245 of 345 · Use Reconnaissance Tools to Perform Network Scanning [Guided] · 🔒 Infrastructure Labs
- Lab 246 of 345 · Perform Network Scanning to Find Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 247 of 345 · Implement a Host-Based Intrusion Detection System [Guided] · 🔒 Infrastructure Labs
- Lab 248 of 345 · Implement Snort to Evaluate Network Communications [Guided] · 🔒 Infrastructure Labs
- Lab 249 of 345 · Harden Network Security [Guided] · 🔒 Infrastructure Labs
- Lab 250 of 345 · Perform Web Server Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 251 of 345 · Establish Secure Communications Between Systems by Using SSH for Remote Access [Guided] · 🔒 Infrastructure Labs
- Lab 252 of 345 · Can You Perform Network and Vulnerability Scanning? [Advanced] · 🔒 Infrastructure Labs
- Lab 253 of 345 · Can You Implement a Host-Based Intrusion Detection System? [Advanced] · 🔒 Infrastructure Labs
- Lab 254 of 345 · Can You Manage Network, Web, and Remote Access Security? [Advanced] · 🔒 Infrastructure Labs
- Lab 255 of 345 · Can You Use Snort, IPSec, Wireshark, Nikto, Nmap, and Wapiti to Identify Network Vulnerabilities? [Expert] · 🔒 Infrastructure Labs
- Lab 256 of 345 · Using the OWASP Zed Attack Proxy Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 257 of 345 · Using the Burp Suite Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 258 of 345 · Use the Nikto Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 259 of 345 · Use the Arachni Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 260 of 345 · Use Web Application Scanners [Advanced] · 🔒 Infrastructure Labs
- Lab 261 of 345 · Use Greenbone Security Manager to Identify Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 262 of 345 · Use Nmap for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 263 of 345 · Use hping for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 264 of 345 · Use Responder for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 265 of 345 · Data Recovery with Autopsy · 🔒 Membership
- Lab 266 of 345 · Dynamic Malware Analysis · 🔒 Membership
- Lab 267 of 345 · Hash Verification · 🔒 Membership
- Lab 268 of 345 · Implement Single System Changes in Firewall · 🔒 Membership
- Lab 269 of 345 · Introduction to Squert · 🔒 Membership
- Lab 270 of 345 · Log Event Reports · 🔒 Membership
- Lab 271 of 345 · Microsoft Baseline Security Analyzer · 🔒 Membership
- Lab 272 of 345 · Recover from Incident · 🔒 Membership
- Lab 273 of 345 · Setting up Filters and Queries in Kibana · 🔒 Membership
- Lab 274 of 345 · Validate Indications of Compromise: Analysis of PE File · 🔒 Membership
- Lab 275 of 345 · Vulnerability Analysis/Protection · 🔒 Membership
- Lab 276 of 345 · WebApp Attack PCAP Analysis · 🔒 Membership
- Lab 277 of 345 · Perform Log Analysis and Task Automation [Guided] · 🔒 Infrastructure Labs
- Lab 278 of 345 · Perform Backup Options to Allow for Lost File Restoration [Guided] · 🔒 Infrastructure Labs
- Lab 279 of 345 · Implement New Security Policies [Guided] · 🔒 Infrastructure Labs
- Lab 280 of 345 · Explore Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 281 of 345 · Find Network System Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 282 of 345 · Evaluate and Customize Security Policy Templates [Guided] · 🔒 Infrastructure Labs
- Lab 283 of 345 · Perform Open Source Intelligence (OSINT) Gathering Operations [Guided] · 🔒 Infrastructure Labs
- Lab 284 of 345 · Can You Manage Logs with Scripts, Perform File Restoration, and Perform Vulnerability Scans? [Advanced] · 🔒 Infrastructure Labs
- Lab 285 of 345 · Can You Use GPOs and Security Templates as Part of IR? [Advanced] · 🔒 Infrastructure Labs
- Lab 286 of 345 · Can You Examine Network Communications by Using Incident Response Tools? [Advanced] · 🔒 Infrastructure Labs
- Lab 287 of 345 · Can You Perform File Restoration, Manage GPOs, and Perform OSINT? [Expert] · 🔒 Infrastructure Labs
- Lab 288 of 345 · Advanced Techniques for Malware Recovery · 🔒 Membership
- Lab 289 of 345 · Analysis and Recommendation Report · 🔒 Membership
- Lab 290 of 345 · Analyze and Classify Malware · 🔒 Membership
- Lab 291 of 345 · Collecting Logs and Verifying Syslog Aggregation · 🔒 Membership
- Lab 292 of 345 · Conduct Root Cause Analysis for System Crashes · 🔒 Membership
- Lab 293 of 345 · Creating SIEM Reports with Splunk · 🔒 Membership
- Lab 294 of 345 · Disable User Account on Windows 10 · 🔒 Membership
- Lab 295 of 345 · Identifying Malicious Network Connections · 🔒 Membership
- Lab 296 of 345 · IDS Setup and Configuration · 🔒 Membership
- Lab 297 of 345 · Linux Users and Groups · 🔒 Membership
- Lab 298 of 345 · Log Analysis · 🔒 Membership
- Lab 299 of 345 · Log Correlation · 🔒 Membership
- Lab 300 of 345 · Parse Files Out of Network Traffic · 🔒 Membership
- Lab 301 of 345 · Protect Against Beaconing · 🔒 Membership
- Lab 302 of 345 · Searching for Indicators of Compromise · 🔒 Membership
- Lab 303 of 345 · Setting Up SYSLOG Forwarding From a Windows System · 🔒 Membership
- Lab 304 of 345 · Vulnerability Scanner Set-up and Configuration · 🔒 Membership
- Lab 305 of 345 · Vulnerability Scanner Set-up and Configuration with OpenVAS · 🔒 Membership
- Lab 306 of 345 · Whitelist Comparison · 🔒 Membership
Step 4 — Network analysis
Read packets and write the rule that catches the next one.
🔒 The full roadmap adds here: 2 full courses · hands-on labs 307–317 of 345 (courses in Membership · 11 labs in Infrastructure Labs)
- Course · Master Wireshark 3 in 5 Days · 🔒 Membership
- Course · Snort Intrusion Detection, Rule Writing, and PCAP Analysis · 🔒 Membership
- Lab 307 of 345 · Implement Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 308 of 345 · Perform an Effective Capture [Guided] · 🔒 Infrastructure Labs
- Lab 309 of 345 · Use Display Filters [Guided] · 🔒 Infrastructure Labs
- Lab 310 of 345 · Modify Display Filter Functionality [Guided] · 🔒 Infrastructure Labs
- Lab 311 of 345 · Recreate Data Flows [Guided] · 🔒 Infrastructure Labs
- Lab 312 of 345 · Recreate Data Content [Guided] · 🔒 Infrastructure Labs
- Lab 313 of 345 · Use Wireshark to Discover Evidence of Network Attacks [Guided] · 🔒 Infrastructure Labs
- Lab 314 of 345 · Can You Customize Profiles and Filters in Wireshark? [Advanced] · 🔒 Infrastructure Labs
- Lab 315 of 345 · Can You Display Customizations and Exploration of Captured Traffic by Using Wireshark? [Advanced] · 🔒 Infrastructure Labs
- Lab 316 of 345 · Can You Extract Intercepted Files and Perform Password Attack Discovery? [Advanced] · 🔒 Infrastructure Labs
- Lab 317 of 345 · Can You Explore the Varied Uses of Wireshark? [Expert] · 🔒 Infrastructure Labs
Step 5 — Hunt in the SIEM and EDR
Hunt across the endpoint with Defender XDR advanced hunting and across the SIEM with the QRadar labs on the CySA+ step, then let AI speed the triage.
🔒 The full roadmap adds here: 1 full course · hands-on labs 318–326 of 345 (course in Membership · 9 labs in Infrastructure Labs)
- Course · ChatGPT for SOC Analyst: Master Cyber Security with AI · 🔒 Membership
- Lab 318 of 345 · Working with Microsoft Defender Products [Prerequisite Lab] · 🔒 Infrastructure Labs
- Lab 319 of 345 · Introduction to Microsoft Defender Overview [Guided] · 🔒 Infrastructure Labs
- Lab 320 of 345 · Microsoft Defender for Identity Setup [Guided] · 🔒 Infrastructure Labs
- Lab 321 of 345 · Microsoft Defender for Endpoint [Guided] · 🔒 Infrastructure Labs
- Lab 322 of 345 · Comprehensive Security Management with Microsoft Defender and Entra ID [Advanced] · 🔒 Infrastructure Labs
- Lab 323 of 345 · Microsoft Defender for Office 365 [Guided] · 🔒 Infrastructure Labs
- Lab 324 of 345 · Microsoft Defender for Cloud Apps [Guided] · 🔒 Infrastructure Labs
- Lab 325 of 345 · Advanced Threat Hunting with Microsoft 365 Defender [Guided] · 🔒 Infrastructure Labs
- Lab 326 of 345 · Incident Response with Microsoft Defender XDR [Expert] · 🔒 Infrastructure Labs
Step 6 — Intelligence and ATT&CK
Turn threat intelligence into hunting hypotheses mapped to the framework hunters speak.
🔒 The full roadmap adds here: 2 full courses (Membership)
- Course · MITRE ATT&CK Framework Essentials · 🔒 Membership
- Course · Cyber Threat Intelligence - Basics & Fundamentals · 🔒 Membership
Step 7 — Script the hunt
Automate the searches you run every day in Python and PowerShell.
🔒 The full roadmap adds here: 1 full course · hands-on labs 327–345 of 345 (course in Membership · 19 labs in Infrastructure Labs)
- Course · TOTAL: Introduction to Python · 🔒 Membership
- Lab 327 of 345 · Manipulate Strings in Python [Guided] · 🔒 Infrastructure Labs
- Lab 328 of 345 · Manage the Flow of Execution by Using Loops in Python [Guided] · 🔒 Infrastructure Labs
- Lab 329 of 345 · Create Branching Logic in Python [Guided] · 🔒 Infrastructure Labs
- Lab 330 of 345 · Define and Use Functions in Python [Guided] · 🔒 Infrastructure Labs
- Lab 331 of 345 · Store Data in Python Data Structures [Guided] · 🔒 Infrastructure Labs
- Lab 332 of 345 · Handle Errors and Exceptions in Python [Guided] · 🔒 Infrastructure Labs
- Lab 333 of 345 · Manage Local Accounts by Using Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 334 of 345 · Manage Network Settings by Using Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 335 of 345 · Sort and Select Objects in the Pipeline Using Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 336 of 345 · Filter Objects in the Pipeline Using Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 337 of 345 · Enumerate Objects in the Pipeline Using Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 338 of 345 · Use Variables in Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 339 of 345 · Use Arrays in Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 340 of 345 · Work with Object Variables in Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 341 of 345 · Use Variables and Arrays in Windows PowerShell [Advanced] · 🔒 Infrastructure Labs
- Lab 342 of 345 · Run Background Jobs in Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 343 of 345 · Create Scheduled Jobs with Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 344 of 345 · Schedule Tasks Using Windows PowerShell [Guided] · 🔒 Infrastructure Labs
- Lab 345 of 345 · Implement Jobs and Tasks with Windows PowerShell [Advanced] · 🔒 Infrastructure Labs
Do it hands-on
The full Threat Hunter roadmap
The same steps with every course and the hands-on labs, and your progress tracked.
The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytimeAdvanced
AI-Driven Security Engineering
Become the Cyber Security Expert the AI Era Needs.
StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”
Explore the AI Master’s →Create your free account to open all 2,396 free items
The 49 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.