Back to top
ShiftZero
SpecialtiesPricingFor teams
Start free
ShiftZero
SpecialtiesPricingFor teams
Start free
ShiftZero

First shift in cybersecurity

Platform

  • How it works
  • Specialties
  • Pricing
  • Try a free shift
  • For companies
  • About ShiftZero

Resources

  • Guide
  • FAQ
  • Verify a certificate

Legal

  • Privacy
  • Terms
  • Refund policy
  • Contact us

Built for cybersecurity analysts — ShiftZero © 2026

Loading
Available for hands-On training

Threat hunting

Practice building hunting hypotheses, analyzing suspicious behavior, and correlating indicators before they become incidents.

45 tickets available13 live labs
Start your first shift freeBrowse scenarios

Interactive live labs

Real terminals and hosts right in your browser.

Realistic incidents

Raw logs and evidence as they reach a real SOC.

Instant review against senior-analyst criteria

Instant feedback on your decisions and reasoning.

01

What you will learn

  • Build threat hunting hypotheses
  • Analyse suspicious behaviour in logs
  • Correlate threat indicators into clear context
  • Use threat intelligence to drive hunts
  • Document the results of a hunt
02

Example shift tickets

Hands-on tasks like those an analyst receives on a real workday.

  • TKT-001Investigation

    Hunt for suspicious beaconing in proxy logs

  • TKT-002Investigation

    Link threat indicators to insider behavior

  • TKT-003Investigation

    Form a hunting hypothesis from a CTI report

03

How A shift works

  1. 1

    Open the shift

  2. 2

    Review the evidence

  3. 3

    Make the decision

  4. 4

    Write analyst notes

  5. 5

    Receive senior review

04

Who it is for

For anyone interested in threat hunting and proactive threat detection.

From basics to challenge

05

Other specialties

Security operations37

Practice monitoring security alerts, analyzing logs, triaging incidents, and making escalation decisions inside a SOC.

Penetration testing5

Practice interpreting penetration test results, reviewing scope, rating risk, and writing safe remediation advice.

GRC

Practice reviewing risks, controls, policies, compliance, and security exceptions from a business perspective.

Cloud security18

Practice reviewing cloud configuration, access permissions, external exposure, logs, and cloud environment risks.

Network security12

Practice analyzing network alerts, reviewing firewalls, reading traffic, and assessing network infrastructure risk.

Incident response17

Practice containment and escalation decisions, evidence collection, and coordinating response during security incidents.

Ready For Your First Shift?

Sign in with Google to unlock this specialty's tickets and live labs, and follow your progress and instant reviews.

Start free with Google