Purple Edge
Get started

Threat Detection and Hunting

advanced4 labsSubscription

Hunt the intruders your alerts miss: write a hypothesis around an ATT&CK technique, build a baseline, stack and pivot across network, logon and process data, and turn every finding into a tested detection rule.

This path is available with a Purple Edge subscription. Sign in to read the full overview and start the labs.

Labs in this path

  1. 1
    intermediate Subscription

    Thinking Like a Threat Hunter

    Why alerts miss real intruders, and how a hunter goes looking anyway: a hypothesis, the right data, a picture of normal, and an eye for the rare.

    40 min3 tasksfoundations
  2. 2
    intermediate Hands-on lab Subscription

    Threat Hunting Fundamentals: Hunt from a Baseline

    Your first real hunt: one hypothesis, one written baseline, and a server that is talking to somewhere it never should.

    60 min3 tasksfoundations
  3. 3
    advanced Hands-on lab Subscription

    Hunting a Specific ATT&CK Technique: Valid Accounts

    Take one named ATT&CK technique, learn what its normal use looks like, and add context until the one misused account stands out.

    70 min3 tasksfoundations
  4. 4
    advanced Hands-on lab Subscription

    Capstone: Find the Undetected Intrusion

    One warning from a partner, no alert anywhere. Pivot from clue to clue across three data sources to the first infected machine, then make sure this never goes unseen again.

    90 min3 tasksfoundations

Unlock this lab

Launch the lab in your browser. Real Kali, Ubuntu and Windows targets, guided step by step. No setup, no VM downloads.

Create free accountSign in to start

Updated 2026-11-01

We use cookies for analytics and advertising to improve Purple Edge and measure our campaigns. You can accept or decline non-essential cookies.