What will I get if I purchase the Certificate?

When you purchase a Certificate you get access to all course materials, including graded assignments. Upon completing the course, your electronic Certificate will be added to your Accomplishments page - from there, you can print your Certificate or add it to your LinkedIn profile.

Is financial aid available?

Yes. In select learning programs, you can apply for financial aid or a scholarship if you can’t afford the enrollment fee. If fin aid or scholarship is available for your learning program selection, you’ll find a link to apply on the description page.

Cyber Threat Hunting with Splunk & Jupyter

Build in-demand skills with a full year of Coursera Plus, now $239. Save now.

Cyber Threat Hunting with Splunk & Jupyter

Instructors: Archan Choudhury

Included with Learn more

6 modules

Gain insight into a topic and learn the fundamentals.

Intermediate level

Recommended experience

9 hours to complete

Flexible schedule

Learn at your own pace

6 modules

Gain insight into a topic and learn the fundamentals.

Intermediate level

Recommended experience

9 hours to complete

Flexible schedule

Learn at your own pace

What you'll learn

Explore the full threat hunting lifecycle and how machine learning strengthens hypothesis-driven threat investigation and detection.
Analyze and visualize raw log data using Pandas, Seaborn, and Matplotlib in Jupyter for effective cyber threat hunting and threat analysis.
Apply advanced threat hunting techniques such as Isolation Forest and DBSCAN to detect anomalies across real-world telemetry data.
Design and execute a complete ML-powered hunt in Splunk and Jupyter to identify suspicious behavior and strengthen threat detection workflows.

Skills you'll gain

Tools you'll learn

Details to know

Shareable certificate

Add to your LinkedIn profile

Assessments

4 assignments¹

AI Graded see disclaimer

Taught in English

See how employees at top companies are mastering in-demand skills

Learn more about Coursera for Business

logos of Petrobras, TATA, Danone, Capgemini, P&G and L'Oreal

There are 6 modules in this course

In today's rapidly evolving digital landscape, cyber threats are becoming increasingly sophisticated and elusive. Attackers employ advanced threat hunting techniques to infiltrate systems, often bypassing traditional security measures. For cybersecurity specialists and security professionals, this presents a significant challenge: how can we defend against threats that are designed to evade detection? The answer lies in integrating data science with modern cyber threat hunting practices.

This course is specifically designed for defenders who want to stay ahead of emerging threats by blending human intuition with machine-driven analytics. In the age of data overload, it's not enough to rely on outdated threat detection approaches. Defenders need to harness the power of modern data science tools and techniques to uncover hidden anomalies, detect behavioral patterns, and identify subtle signals of compromise that are the very foundation of effective threat hunting in cyber security. This course equips you with the skills needed to navigate and combat the evolving cybersecurity landscape using cutting-edge cyber threat hunting tools and data science techniques. Throughout the course, you will dive deep into log analysis, threat hunting hypotheses, and machine learning models applied to real-world cybersecurity scenarios. You will gain hands-on experience with industry-standard threat hunting tools like Splunk and Jupyter Notebooks, enabling you to apply learned techniques to live data and active threats within your organization or a structured training environment. Aligned with a practical model for conducting cyber threat hunting, this course is built for defenders who want to sharpen their hunting instincts and use data more effectively. It is ideal for SOC analysts ready to move beyond alert triage, threat hunters seeking to uncover deeper behavioral patterns, blue team engineers building repeatable threat hunting workflows, and cybersecurity students eager to gain hands-on experience with threat hunting Security Information and Event Management (SIEM) platforms like Splunk and Jupyter. Learners should have a basic understanding of Python, familiarity with common log formats, and a solid grasp of core threat hunting cybersecurity concepts. With these foundations in place, you'll move comfortably into data-driven workflows and hands-on cyber threat hunting techniques explored throughout the course. By the end, you'll understand the full threat hunting lifecycle and how machine learning strengthens hypothesis-driven threat investigations. You'll be able to clean, enrich, and visualize raw telemetry; apply threat analysis and anomaly detection techniques like Isolation Forest and DBSCAN; and design a complete ML-powered hunt in Splunk and Jupyter that detects suspicious behavior with clarity and confidence henceforth building the core competencies expected of a skilled cyber threat hunter.

In this course, you’ll learn how to combine threat hunting fundamentals with data science techniques to uncover hidden threats that traditional security tools often miss. You’ll work with real log data, build hunting hypotheses, and apply machine learning models to detect anomalies, behavioral patterns, and subtle signs of compromise across enterprise environments. Through guided instruction, hands-on labs, and practical examples using Splunk and Jupyter Notebooks, you’ll develop the skills to operationalize ML-powered threat hunts, strengthen detection workflows, and respond more effectively to advanced, evasive attackers.

What's included

1 video1 reading

In this module, you’ll explore what threat hunting really means and why it has become essential for modern security teams. We’ll break down how hunters move beyond automated tools to search for hidden or unusual activity that may signal an active compromise. You’ll learn the core concepts, terminology, and frameworks that shape effective hunting, along with the mindset of assuming adversaries may already be inside your environment. By the end, you’ll understand why proactive hunting is critical for stopping attacks early, reducing impact, and strengthening your overall detection strategy.

What's included

10 videos1 reading1 assignment1 peer review1 discussion prompt

10 videosTotal 64 minutes

Module Introduction 3 minutes
Overview of Threat Hunting Concepts and Importance 5 minutes
How to Plan Threat Hunt 9 minutes
How to Document Threat Hunt 8 minutes
Hunting Methodologies 6 minutes
Telemetry and Data Sources 7 minutes
Essential Tools for Threat Hunting 6 minutes
Explore MITRE ATT&CK 8 minutes
How to Use MITRE Navigator 6 minutes
From ATT&CK to Action: Building a Hunt Matrix for Real Threats 6 minutes

1 readingTotal 5 minutes

MITRE Framework 5 minutes

1 assignmentTotal 20 minutes

Introduction to Industrial Threat Hunting 20 minutes

1 peer reviewTotal 10 minutes

Hands-On-Learning: Performing Threat Actor Profiling Using MITRE ATT&CK and MITRE Navigator10 minutes

1 discussion promptTotal 10 minutes

The Impact of Proactive Threat Hunting in Your Environment10 minutes

In this module, you’ll learn how data science strengthens modern threat hunting by helping you make sense of large, noisy security datasets. We’ll walk through the essentials of cleaning and shaping log data, visualizing behaviors, and building simple machine learning models to spot anomalies. You’ll get hands-on practice with Python tools like pandas, scikit-learn, and Jupyter Notebooks, and see how these techniques feed into SIEM platforms such as Splunk and Elastic. By the end, you’ll understand how data science supports faster detection, smarter investigations, and repeatable, automated hunting workflows.

What's included

10 videos1 reading1 assignment1 peer review1 discussion prompt

10 videosTotal 69 minutes

Module Introduction 3 minutes
Parsing and Cleaning Logs 5 minutes
Techniques for Log Parsing and Cleaning6 minutes
Effective Log Parsing and Cleaning Techniques7 minutes
Introduction to Feature Engineering 6 minutes
Visualizing Behaviors 12 minutes
Threat Hunting Visualization 6 minutes
What is Security-Focused Visualization 7 minutes
Create Your Own Visualization8 minutes
Top Security Visualizations Every Threat Hunter Should Use 9 minutes

1 readingTotal 5 minutes

Effective Data Visualization 5 minutes

1 assignmentTotal 20 minutes

Data Science for Cybersecurity20 minutes

1 peer reviewTotal 16 minutes

Hands-On-Learning: Building a Security Visualization to Detect Anomalous Login Activity 16 minutes

1 discussion promptTotal 10 minutes

Data Cleaning as the Foundation of Threat Hunting 10 minutes

In this module, you’ll explore the unsupervised machine learning techniques that power modern anomaly detection in security environments. We’ll break down how models like Isolation Forest, DBSCAN, Z-Score Analysis, and One-Class SVM uncover unusual patterns without relying on labeled data. You’ll practice applying these algorithms to real-world scenarios such as suspicious logins, odd network traffic, and unusual system behavior. By the end, you’ll understand how these ML methods help you surface hidden threats that traditional rules often overlook.

What's included

10 videos1 reading1 assignment1 peer review1 discussion prompt

10 videosTotal 67 minutes

Module Introduction 3 minutes
Introduction to Unsupervised ML 4 minutes
Understand Different Process of Unsupervised Learning Models 6 minutes
Evaluating and Tuning ML Models 5 minutes
Suspicious Login Hunting 11 minutes
Graphical Representation of Anomaly 11 minutes
Event Correlation 7 minutes
General Pitfalls in Threat Detection 5 minutes
Different ML Techniques 5 minutes
How to Choose Best ML Model 9 minutes

1 readingTotal 5 minutes

Splunk Machine Learning Toolkit Guide 5 minutes

1 assignmentTotal 20 minutes

ML Algorithms for Threat Detection20 minutes

1 peer reviewTotal 10 minutes

Hands-On-Learning: Performing an ML-Based Hunt to Detect Anomalous Login Activity 10 minutes

1 discussion promptTotal 10 minutes

Overcoming Challenges in ML Model Tuning10 minutes

In this module, you’ll learn how to turn machine learning models and analytical techniques into practical, repeatable threat-hunting workflows. We’ll walk through how to ingest and prepare data in Splunk, write SPL for clean feature inputs, and build detection notebooks that analyze and score events in Jupyter. You’ll also see how both platforms work together to run full end-to-end hunts, from data extraction to investigation. By the end, you’ll be able to operationalize ML-driven detections and apply them directly to real security telemetry.

What's included

10 videos1 reading1 assignment1 peer review1 discussion prompt

10 videosTotal 58 minutes

Module Introduction 4 minutes
Understand Splunk Architecture 5 minutes
Log Ingestion in Splunk 7 minutes
Search Operation in Splunk 6 minutes
Writing SPL for Data Prep 6 minutes
Jupyter Detection Pipeline 5 minutes
Threat Hunt Notebook Example 6 minutes
Splunk and Jupyter7 minutes
Elastic and Jupyter6 minutes
Real Hunt Execution 8 minutes

1 readingTotal 5 minutes

Finding a Needle in a Haystack: Machine Learning at the Forefront of Threat Hunting Research 5 minutes

1 assignmentTotal 20 minutes

Operationalizing in Splunk and Jupyter20 minutes

1 peer reviewTotal 10 minutes

Hands-On-Learning: End-to-End Threat Hunt Using Splunk, Elastic, and Jupyter 10 minutes

1 discussion promptTotal 10 minutes

Applying Real Hunt Execution Techniques10 minutes

In this wrap-up module, you’ll bring all your threat-hunting skills together by building a complete anomaly-based detection workflow using Splunk and Jupyter. This final project puts your log analysis, SPL queries, and ML techniques into practice, showing your ability to uncover hidden threats, visualize suspicious behavior, and map findings to ATT&CK. It’s your chance to demonstrate real-world readiness and apply everything you’ve learned across the course.

What's included

1 video1 peer review

Instructors

Archan Choudhury

STARWEAVER

1 Course263 learners

Starweaver

STARWEAVER

644 Courses1,331,524 learners

Offered by

STARWEAVER

Why people choose Coursera for their career

Felipe M.

Learner since 2018

"To be able to take courses at my own pace and rhythm has been an amazing experience. I can learn whenever it fits my schedule and mood."

Jennifer J.

Learner since 2020

"I directly applied the concepts and skills I learned from my courses to an exciting new project at work."

Larry W.

Learner since 2021

"When I need courses on topics that my university doesn't offer, Coursera is one of the best places to go."

Chaitanya A.

"Learning isn't just about being better at your job: it's so much more than that. Coursera allows me to learn without limits."

What brings you to Coursera today?

Start my career

Change my career

Grow in my current role

Explore topics outside of work

Give yourself skills that last, now $239
Save now
Gift your team new skills
Save 40% now

Frequently asked questions

This course is ideal for SOC analysts, threat hunters, blue team engineers, and cyber security specialist technicians who are looking to move beyond alert triage and build advanced, data-driven cyber threat hunting capabilities. It is equally valuable for cybersecurity students and aspiring cyber threat hunters seeking structured threat hunter training using industry-standard tools like Splunk and Jupyter.

This cyber threat hunting course is a hands-on, data-driven program designed to equip security professionals with the skills to proactively detect, investigate, and neutralize advanced cyber threats before they cause damage. Built around a practical model for conducting cyber threat hunting, the course covers the full threat hunting lifecycle, from log analysis and behavioral pattern recognition to ML-powered anomaly detection using industry-standard cyber threat hunting tools like Splunk and Jupyter Notebooks. Whether you are a SOC analyst, blue team engineer, or aspiring cyber threat hunter, this course delivers the threat hunting training and certification-aligned skills needed to excel in today's high-stakes cybersecurity environment.

This course is structured around a practical model for conducting cyber threat hunting, guiding you progressively through the full hunting lifecycle, from forming data-driven hypotheses to detecting and neutralizing suspicious behavior. By the end, you will have the hands-on threat hunting techniques, threat analysis experience, and ML-powered detection capabilities expected of a confident cyber threat hunter with practical fluency in threat hunting.

No prior AI experience is required. Basic Python proficiency, familiarity with common log formats, and foundational threat hunting cybersecurity concepts are sufficient to get started. The course is thoughtfully structured to progressively build your competence from core cyber threat hunting principles to advanced machine learning applications in threat detection workflows.

Unlike standard threat hunting training and certification programs, this course delivers a uniquely integrated learning experience, combining machine learning, threat hunting digital forensics, hands-on threat hunting workflows, and real-world threat investigation scenarios. It bridges cyber threat intelligence training with practical detection techniques, equipping learners with a complete skill set across threat hunting cybersecurity thereby making it one of the most comprehensive cyber threat hunting programs available online today.

To access course materials, assignments, and earn a Certificate, you'll need to purchase the Certificate experience when you enroll in a course. Eligible learners may also have the option to start with a Free Trial. Some courses may also offer a Full Course, No Certificate option. This lets you access course materials, submit required assessments, and receive a final grade, but you won't be able to earn or purchase a Certificate.