I85PREP
⌘ K
PECB Certified Cyber Threat Analyst study materials
PECB Certified Cyber Threat Analyst study resources

PECB Certified Cyber Threat Analyst: Preparation and Execution Phase of Threat Hunting Programs and Incident Management Plans

PECB Certified Cyber Threat Analyst · Work through your exam, one topic at a time.

All guide sections

Preparation and Execution Phase of Threat Hunting Programs and Incident Management Plans

Domain 2 addresses preparation and execution of threat hunting programs and incident management plans. The exam tests whether you can design a repeatable program, align hunts with business risk, and execute a hunt that hands evidence cleanly into incident response.

Core rules and concepts

  • A program needs a charter, sponsor, scope, roles, data sources, tooling, legal and privacy constraints, and a hypothesis backlog prioritized by risk.
  • Preparation includes data readiness: logging coverage, retention, time synchronization, asset context, and query performance. A hunt without usable telemetry is only a wish.
  • An incident management plan defines severity, escalation, communication, evidence handling, containment authority, and recovery criteria. Test it with tabletop exercises.
  • Execution follows a hunt plan: objective, hypothesis, scope, data collection, analysis, validation, findings, and escalation.
  • Preserve evidence before containment actions; record chain of custody and timestamps.

Worked example

Prepare a hunt for credential dumping. Confirm that EDR process telemetry, Windows Security logs, and memory-capture tooling are available. Write success criteria: identify unauthorized access to LSASS memory and related credential theft behavior. During execution, query for suspicious process access to lsass.exe, unusual parent processes, and service creation. A hit on a server shows a non-standard tool accessing LSASS under a service account. The hunter validates the account owner, change record, and file reputation. No approved change exists, so the finding is escalated as an incident; evidence is exported before isolating the host. The hunt report records coverage gaps and a new detection idea.

Traps that cost marks

Running hunts without a charter or success criteria. Treating the incident management plan as a document that need not be exercised. Skipping evidence preservation. Confusing a hunt finding with confirmed compromise before validation.