Vulnerability Management and Threat Hunting

Learn the three standards that structure every vulnerability conversation: CVE (identifier), CVSS (severity score), EPSS (exploit probability score). By the end you will be able to read a vulnerability report and tell Camila which vulnerabilities actually matter — distinguishing high-CVSS-low-EPSS (hype) from medium-CVSS-high-EPSS (actively exploited, real priority).

Learn the operational discipline that turns vulnerability priorities into actually-patched systems: patch testing, deployment pipelines, change management, exception tracking, and the metrics that distinguish a mature patch program from a reactive one. By the end you will design a Beacon Harbor patch management pipeline and know the KPIs that prove it's working.

Learn the discipline that distinguishes real threat hunting from "running queries looking for weird stuff" — hypothesis-driven hunting rooted in threat intelligence, ATT&CK, and your environment's specific attack surface. By the end you will formulate hunt hypotheses, know the hunt lifecycle (hypothesis → query → analyze → decide → document), and understand how hunting feeds detection engineering.

Apply the KQL fundamentals from Course 3 to real hunt scenarios: multi-table joins, lookups against watchlists, time-series anomaly detection, and the KQL functions that make hunting queries practical. By the end you will author KQL hunting queries for common attacker techniques (lateral movement via psexec, OAuth consent abuse, service account credential reuse).

Measure a hunting program's maturity using the Hunt Maturity Model (HMM0-HMM4), track meaningful metrics (hunts per quarter, TP rate, promotion rate, coverage change), and understand what a mature hunting program ACTUALLY delivers vs what vendors promise.