Threat Hunter
Follow this curated learning path to proactively search for hidden threats as a Threat Hunter.
These five courses guide you through investigating threats, building advanced log queries, analyzing data in Notebooks, and detecting compromises on hosts and containers before they escalate. Engage in hands-on practice within live demo environments to gain experience analyzing real-time data using a free Datadog trial account.
This path is designed specifically for Threat Hunters and other roles responsible for proactively searching for hidden or emerging threats across the environment.
You’ll learn how to do the following:
Detect and Investigate Threats with Cloud SIEM
Secure your cloud environments with Datadog Cloud SIEM and cloud provider Content Packs. Explore out-of-the-box threat detection rules. Investigate incoming threats using Security Signals, Signals Explorer, and Cloud SIEM Investigator.
Dive Deeper into Log Queries and Aggregations
Create visualizations for counts and statistics of log attributes. Build multiple queries and formulas. Use functions to transform data in visualizations. Aggregate logs based on patterns and transactions (related sequences of events).
Enhance Log Querying and Analytics with Reference Tables, Subqueries, and Calculated Fields
Combine metadata with your logs using Reference Tables. Filter one set of logs against another set of logs using Subqueries. Create new fields using existing tags and attributes at query time using Calculated Fields.
Log Analytics with Notebooks
Learn how to use reference tables, transformation cells, and SQL queries in Datadog Notebooks to investigate log data. Join data from multiple sources to analyze suspicious IP activity and calculate the business impact of failed transactions.
Detect Host and Container Compromises with Workload Protection
Monitor file, network, process, and kernel activity with Workload Protection. Detect and investigate intrusions and running malware in real-time. Secure containerized and host-based workloads.
