Lesson 3: Conducting Threat Hunting and Defending Using Cisco Technologies – Monitoring, Threat Hunting, Investigation, and Response

This lesson provides guided coverage of monitoring, threat hunting, investigation, and response within the Conducting Threat Hunting and Defending Using Cisco Technologies for Cybersecurity v1.1 Training.

Topics Covered

• Security events, alerts, dashboards, logs, telemetry, and evidence collection
• Traffic analysis, intrusion events, malware indicators, and behavioral context
• Threat hunting hypotheses, queries, correlations, and investigation workflow
• Incident triage, containment, escalation, documentation, and response actions
• Compliance monitoring, reporting, audit evidence, and policy exceptions
• Integration with security tools, APIs, automation, and ticketing
• Scenario-based investigation and response exercise

Practical Outcome

Learners complete the lesson with a clear understanding of the workflow, the ability to validate the expected result, and a structured approach to common troubleshooting tasks.