Threat Hunter — career path
StationX Advanced
The defender who goes looking. Security+, SOC fundamentals and CySA+ first, then packet analysis, hunting in the SIEM and EDR, intelligence and ATT&CK, and the scripting that scales a hunt.
8 courses · 55 sections · 311 lectures · 54 labs · ≈ 49 h of hands-on labs
Free to start: the free lessons and guides for this roadmap →
Try a free SOC lab: Shut the door (~4 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Security foundation
The baseline every SOC hires for.
follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
Learn
- PathFollow the CompTIA Security+ (SY0-701) path — the entry certification for every blue-team role
11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs
9 steps — The industry-standard entry certification for a cyber security role.
Step 2 — SOC foundations
Know what a security operations centre does all day before you hunt in one. Skip it if you've done the SOC Analyst path.
2 courses · 17 sections · 81 lectures · 15 labs
Learn
- CourseBlue Team Boot Camp: Defending Against Hackers (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
6 sections · 60 lectures
- Training Overview 2
- Section 1: Introduction 3
- Section 2: Risk Analysis and Threat Intelligence 6
- Section 3: Endpoint Security 26
- Section 4: Network Security 13
- Section 5: Log Aggregation and Correlation 10
- CourseSOC for Blue Teams (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 21 lectures
- Training Overview 2
- Section : Introduction to Cyber Defense 2
- Section : Understanding Adversary Tactics 2
- Section : Roles and Responsibilities in Cyber Operations 1
- Section : Cyber Threat Landscape and Frameworks 2
- Section : Log Analysis and Threat Detection 2
- Section : Introduction to Malware Analysis 3
- Section : Malware Analysis Techniques and Tactics 2
- Section : Malware Analysis Process 1
- Section : Network and File-Based Malware Analysis 3
- Audio Version of Training 1
Practise
- Infra LabsSecurity Operations Practitioner — 15 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Enforce Segmentation and Approved Access PathsLevel: GuidedDuration: 1 h
- Harden a JumpBox for Secure AdministrationLevel: GuidedDuration: 1 h
- Secure Privileged Access and Auditing in Active DirectoryLevel: GuidedDuration: 1 h
- Establish a Windows Hardening and Security Logging BaselineLevel: GuidedDuration: 1 h
- Reduce DVWA Exposure by Using Compensating ControlsLevel: GuidedDuration: 1 h
- Implement TLS and Certificate Controls for a ServiceLevel: GuidedDuration: 1 h
- Integrated Hardening Sprint A: Segment, Harden, and Secure ServicesLevel: AdvancedDuration: 1 h 30 min
- Governance and Compliance Evidence CollectionLevel: GuidedDuration: 1 h
- Prioritize Risks and Implement One RemediationLevel: GuidedDuration: 1 h
- Threat Modeling to Controls: Identify Risks and Implement MitigationsLevel: GuidedDuration: 1 h
- Establish centralized logging by onboarding hosts and validating monitoring readinessLevel: GuidedDuration: 1 h
- Hunt Threats Using Intelligence and Rule-Based DetectionLevel: GuidedDuration: 1 h
- Triage, Contain, and Automate Incident ResponseLevel: GuidedDuration: 1 h
- Govern, Detect, Hunt, and Respond Through an Integrated Security Operations SprintLevel: AdvancedDuration: 1 h
- Design, Defend, and Respond Across an End-to-End Security ArchitectureLevel: ExpertDuration: 1 h
Step 3 — The analyst certification
The SOC analyst's certification, with its intelligence, SIEM and incident-response labs — hunters hold it before they hunt.
follows the whole CompTIA CySA+ (CS0-004) roadmap: 5 courses · 35 sections · 188 lectures · 169 labs · ≈ 181 h of hands-on labs
Learn
- PathFollow the CompTIA CySA+ (CS0-004) path — the threat-intelligence, detection and SIEM labs live on this path
5 courses · 35 sections · 188 lectures · 169 labs · ≈ 181 h of hands-on labs
6 steps — The blue-team analyst certification and the natural step after Security+. Security operations, vulnerability management, incident response and reporting.
Step 4 — Network analysis
Read packets and write the rule that catches the next one.
2 courses · 9 sections · 50 lectures · 11 labs
Learn
- CourseMaster Wireshark 3 in 5 Days (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
6 sections · 34 lectures
- Training Overview 2
- Day One 3
- Day Two 8
- Day Three 7
- Day Four 7
- Day Five 7
- CourseSnort Intrusion Detection, Rule Writing, and PCAP Analysis (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
3 sections · 16 lectures
- Training Overview 2
- Lectures 1
- Hands-on Labs 13
Practise
- Infra LabsIntroduction to Wireshark — 11 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Implement WiresharkLevel: GuidedDuration: 30 min
- Perform an Effective CaptureLevel: GuidedDuration: 30 min
- Use Display FiltersLevel: GuidedDuration: 30 min
- Modify Display Filter FunctionalityLevel: GuidedDuration: 30 min
- Recreate Data FlowsLevel: GuidedDuration: 30 min
- Recreate Data ContentLevel: GuidedDuration: 1 h 15 min
- Use Wireshark to Discover Evidence of Network AttacksLevel: GuidedDuration: 1 h 15 min
- Can You Customize Profiles and Filters in Wireshark?Level: AdvancedDuration: 1 h 30 min
- Can You Display Customizations and Exploration of Captured Traffic by Using Wireshark?Level: AdvancedDuration: 1 h 30 min
- Can You Extract Intercepted Files and Perform Password Attack Discovery?Level: AdvancedDuration: 1 h 30 min
- Can You Explore the Varied Uses of Wireshark?Level: ExpertDuration: 2 h
Step 5 — Hunt in the SIEM and EDR
Hunt across the endpoint with Defender XDR advanced hunting and across the SIEM with the QRadar labs on the CySA+ step, then let AI speed the triage.
1 course · 7 sections · 59 lectures · 9 labs
Learn
- CourseChatGPT for SOC Analyst: Master Cyber Security with AI (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
7 sections · 59 lectures
- Training Overview 2
- A Sneek Peek into Cyber Security Mastery with ChatGPT 1
- Getting Started with ChatGPT for Cyber Security 17
- Advanced Prompts with ChatGPT 5 for Cyber Security Analyst 16
- Master Cloud Security with ChatGPT in Azure 11
- Enhance Incident Investigation with ChatGPT and SIEM Solution 11
- Audio Version of Training 1
Practise
- Infra LabsMicrosoft Defender — 9 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Working with Microsoft Defender Products [Prerequisite Lab]Level: PrerequisiteDuration: 1 h
- Introduction to Microsoft Defender OverviewLevel: GuidedDuration: 30 min
- Microsoft Defender for Identity SetupLevel: GuidedDuration: 1 h
- Microsoft Defender for EndpointLevel: GuidedDuration: 45 min
- Comprehensive Security Management with Microsoft Defender and Entra IDLevel: AdvancedDuration: 45 min
- Microsoft Defender for Office 365Level: GuidedDuration: 30 min
- Microsoft Defender for Cloud AppsLevel: GuidedDuration: 30 min
- Advanced Threat Hunting with Microsoft 365 DefenderLevel: GuidedDuration: 1 h
- Incident Response with Microsoft Defender XDRLevel: ExpertDuration: 1 h 30 min
Step 6 — Intelligence and ATT&CK
Turn threat intelligence into hunting hypotheses mapped to the framework hunters speak.
2 courses · 17 sections · 103 lectures
Learn
- CourseMITRE ATT&CK Framework Essentials (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
6 sections · 35 lectures
- Training Overview 2
- Section 1: Introduction 9
- Section 2: Tactics, Techniques, and Procedures (TTP's) 12
- Section 3: Other Learning Resources 4
- Section 4: Update - Adversarial Threat Landscape for AI Systems 7
- Audio Version of Training 1
- CourseCyber Threat Intelligence - Basics & Fundamentals (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 68 lectures
- Training Overview 2
- Introduction 4
- Definitions & Fundamentals 15
- Cyber Threat Intelligence Objectives 6
- CTI Specific Models 15
- CTI Reports - Examples 3
- Use case 1 - Ransomware group Primo-Analysis 8
- Use Case 2 - Darkweb Monitoring 8
- Use Case 3 - Adversary Controlled Infrastructure Hunting 5
- Conclusion 1
- Audio Version of the Training 1
Step 7 — Script the hunt
Automate the searches you run every day in Python and PowerShell.
1 course · 5 sections · 18 lectures · 19 labs
Learn
- CourseTOTAL: Introduction to Python (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
5 sections · 18 lectures
- Training Overview 2
- Chapter 1: Welcome to Python! 6
- Introduction to Programming 5
- Data Processing with Python 4
- Audio 1
Practise
- Infra LabsIntroductory Python — 6 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Manipulate Strings in PythonLevel: GuidedDuration: 1 h
- Manage the Flow of Execution by Using Loops in PythonLevel: GuidedDuration: 30 min
- Create Branching Logic in PythonLevel: GuidedDuration: 45 min
- Define and Use Functions in PythonLevel: GuidedDuration: 45 min
- Store Data in Python Data StructuresLevel: GuidedDuration: 1 h
- Handle Errors and Exceptions in PythonLevel: GuidedDuration: 45 min
- Infra LabsGetting Started with PowerShell — 13 labs 🔒 Add StationX Infrastructure Labs — $149 / year · 3 attempts per lab in any 12 months
- Manage Local Accounts by Using Windows PowerShellLevel: GuidedDuration: 30 min
- Manage Network Settings by Using Windows PowerShellLevel: GuidedDuration: 45 min
- Sort and Select Objects in the Pipeline Using Windows PowerShellLevel: GuidedDuration: 45 min
- Filter Objects in the Pipeline Using Windows PowerShellLevel: GuidedDuration: 45 min
- Enumerate Objects in the Pipeline Using Windows PowerShellLevel: GuidedDuration: 45 min
- Use Variables in Windows PowerShellLevel: GuidedDuration: 45 min
- Use Arrays in Windows PowerShellLevel: GuidedDuration: 45 min
- Work with Object Variables in Windows PowerShellLevel: GuidedDuration: 45 min
- Use Variables and Arrays in Windows PowerShellLevel: AdvancedDuration: 45 min
- Run Background Jobs in Windows PowerShellLevel: GuidedDuration: 45 min
- Create Scheduled Jobs with Windows PowerShellLevel: GuidedDuration: 45 min
- Schedule Tasks Using Windows PowerShellLevel: GuidedDuration: 45 min
- Implement Jobs and Tasks with Windows PowerShellLevel: AdvancedDuration: 45 min
Where this leads
Choose your next roadmap
Advanced · after the job
The AI-Driven Threat Hunter
Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.
See the AI Master's Program →Application-only. A separate programme for when you're ready.