Nebulock Webinar | Threat Hunting 101: From Alerts to Adversaries

Nebulock Webinar | Threat Hunting 101: From Alerts to Adversaries

by Sydney Marrone

Applied Sciences & Engineering Computing & Cybersecurity UComputing and Information TechnologyURComputer security
🎙 Sydney Marrone 👥 3K 📅 February 12, 2026 ⏱ 58 min 👁 126 📄 expert opinion 🧭 2026-08-16
Available in: English (current) Français

Keywords

threat huntingproactive securityhypothesis-drivenPEAK frameworkMITRE ATT&CK

Summary

This WiCyS webinar, presented by Sydney Marrone, Head of Threat Hunting at Nebulock, provides an introductory overview of threat hunting. It begins by contrasting threat hunting with reactive alert monitoring, emphasizing its proactive, hypothesis-driven nature. The speaker introduces the PEAK framework (Prepare, Execute, Act, Knowledge), a structured methodology for conducting hunts, and illustrates it with a live example involving certutil.exe. The webinar also covers how to get started in threat hunting, including resources like MITRE ATT&CK, home labs, and CTFs, and briefly touches on career paths in security. Finally, it introduces the Agentic Threat Hunting Framework as a forward-looking approach integrating AI. The presentation is accessible to beginners and emphasizes the importance of curiosity, creativity, and continuous learning.

118 words

Critical Evaluation

Value of the Information & Strength of the Argument

The webinar provides a solid introduction to threat hunting, clearly explaining its value and methodology. The argumentation is coherent, using the PEAK framework as a structured approach and illustrating it with a practical example. The speaker effectively communicates the importance of proactive hunting and the need for a repeatable process. However, the content is largely conceptual and lacks deep technical detail, making it more suitable for beginners than experienced practitioners. The argumentation is persuasive but relies on anecdotal evidence and general industry knowledge rather than empirical data.

Scientific Rigor, Source Quality, Title Accuracy

The webinar demonstrates reasonable scientific rigor by referencing established frameworks like MITRE ATT&CK and the PEAK framework, which are widely recognized in the cybersecurity community. The speaker also mentions the Mandiant M-Trends report for the statistic on attacker dwell time, adding credibility. However, specific sources are not cited in detail, and the presentation is based on the speaker’s expertise rather than a comprehensive literature review. The title accurately reflects the content, and the webinar fulfills its promise of providing an introductory overview. The presence of a brief promotional segment for WiCyS partners does not detract from the educational value.

201 words

Title / Content Match

The title accurately reflects the content: an introductory webinar on threat hunting, covering fundamentals and a framework.

Quality & Reliability

7/10

The webinar is presented by a recognized threat hunting expert and co-author of the PEAK framework, providing a structured methodology. However, it is largely introductory and relies on anecdotal examples rather than rigorous empirical evidence. The content is consistent with established cybersecurity practices, but lacks in-depth technical detail and independent verification.

Key Moments

Markers derived by PSI from the transcript: the creator did not define chapters.

Cited Sources

  • WiCyS Webinar Channel — The webinar is part of WiCyS strategic partner webinars, and this link is provided in the description for more webinars.

Concurring Sources

  • MITRE ATT&CK — The webinar references MITRE ATT&CK as a key resource for understanding attacker TTPs, which is consistent with industry standards.

Contribution & Novelties

The webinar provides a clear, structured introduction to threat hunting, emphasizing the PEAK framework and the importance of a repeatable methodology. It also introduces the Agentic Threat Hunting Framework, which integrates AI into hunting workflows, offering a forward-looking perspective. The presentation is valuable for beginners seeking to understand the fundamentals and for practitioners looking to formalize their approach.

Pour aller plus loin :

  • MITRE ATT&CK — The knowledge base of adversary tactics and techniques, essential for hypothesis generation.
  • PEAK Threat Hunting Framework — The official Splunk blog post introducing the PEAK framework.
  • Pyramid of Pain — A model for understanding the difficulty of changing different indicators of compromise.

108 words

Radar Profile

The radar profile shows moderate to high scores across all dimensions, with a slightly lower score in technical depth, reflecting the introductory nature of the webinar. The high scores in information quantity and quality indicate a well-structured presentation, while the lower technical level suggests it is more accessible to beginners.

Reliability 7/10

💬 Sur les 0 commentaires analysés, aucune tendance n'est disponible.