MITRE ATT&CK knowledge base
MITRE · Intermediate · Documentation
Free learning material; certificates and service usage are not included. Link checked 2026-10-02.
Open resource ↗BUILD A SKILL / ONE STEP AT A TIME
Threat Detection
Threat detection turns evidence into testable alert logic.
Why is it useful?
It helps distinguish suspicious activity from normal behavior.
Prerequisites
What should I learn?
- ATT&CK mapping
- Detection hypotheses
- Rules
- Testing
- False positives
Practice milestone
Test an ATT&CK-mapped rule against synthetic logs.
A REALISTIC PRACTICE PLAN
50–100 focused hours
Intermediate · approximately 5.0–10.0 weeks at 10 hours/week.
This is an editorial estimate for the listed foundations and exercises, not a promise of mastery. Familiarity comes earlier; practical confidence requires repeated projects. Strong proficiency often takes months or years of continued use.
At 1–2 hours/day, missed days and revisiting prerequisites extend calendar time. Skills can be studied together.
Your learning progress
Self-reported completion does not change your saved analysis or prove proficiency.
Curated learning resources
FREE LEARNING FIRSTElastic Security documentation
Elastic · Intermediate · Documentation
Free learning material; certificates and service usage are not included. Link checked 2026-10-02.
Open resource ↗Career recommendations and learning timelines are educational guidance based on your resume and selected goals. They are not guarantees of employment or professional competency.