Skill Profile

Threat Detection & Analysis

Cybersecurity

"The observable action of monitoring system logs, network traffic, and security alerts to identify indicators of compromise or malicious activity — correlating events across data sources, distinguishing genuine threats from false positives, and escalating confirmed incidents for containment and response."

YOUR SKILLS

Problems This Skill Solves

Breaches that go undetected for months because no one is actively monitoring for signs of intrusion — systematic threat detection reduces dwell time (the period between initial compromise and detection) which is the primary driver of breach severity.
Alert fatigue that causes genuine threats to be missed — applying triage and correlation logic to thousands of daily alerts prioritises the genuine threats requiring investigation from the noise of routine false positives.
Insider threats and compromised credentials going undetected — user and entity behaviour analytics (UEBA) identifies anomalous behaviour patterns that indicate account compromise or malicious insider activity.
Post-incident analysis that cannot reconstruct the attack chain — systematic log collection and retention means forensic investigators can reconstruct the timeline and method of an attack for lessons learned and legal purposes.

Tools Used

SIEM platforms: Splunk, Microsoft Sentinel, IBM QRadar — for log aggregation, correlation rule execution, and alert management EDR (Endpoint Detection and Response): CrowdStrike Falcon, SentinelOne, Microsoft Defender — for endpoint threat detection and investigation MITRE ATT&CK framework — the knowledge base of adversary tactics, techniques, and procedures used to classify and contextualise threat activity Threat intelligence platforms: Recorded Future, ThreatConnect — for enriching detections with context about threat actors and indicators of compromise Network traffic analysis: Zeek, Suricata — for identifying malicious patterns in network flows and packet captures

Roles That Use This Skill

1 total · 1 industry

Specialist

This skill is concentrated in one industry.

Cybersecurity / Technology / Finance

Cybersecurity Analyst

Explore this skill's neighbourhood →

Myths vs Truths

Myth

"If you have a SIEM, you have threat detection covered — the tool does the work."

Truth

A SIEM is a data aggregation and correlation platform — it produces the alerts that trained analysts investigate. Without skilled analysts writing effective detection rules, triaging alerts accurately, and investigating confirmed threats correctly, a SIEM generates noise rather than intelligence. The most expensive SIEM implementation with no skilled analysts is less effective than a modest tool operated by a capable team.

Research & Outlook

AI and machine learning are improving detection accuracy — reducing false positive rates and identifying subtle anomaly patterns that rule-based detection misses. Automated SOAR (Security Orchestration, Automation and Response) platforms are handling tier-1 alert triage at machine speed, shifting human analysts towards investigation, hunting, and detection engineering. The volume and sophistication of threats continues to increase, maintaining strong demand for skilled threat detection professionals despite automation.

See This Skill In Action

Watch a professional demonstrate Threat Detection & Analysis in a real working environment — what it looks like, how it's applied, and why it matters.

Threat Detection & Analysis in practice

A professional demonstrates this skill on the job

Subscribe for updates

Cybersecurity

Threat Detection & Analysis

1role unlocks with this skill

Also Known As

Threat HuntingSOC AnalysisSecurity MonitoringIntrusion DetectionAlert TriageSecurity Analysis

Connected Skills

Network Security Vulnerability Assessment Security Frameworks (ISO 27001/NIST)SIEM Incident Response

Growth Path

Beginner

Monitors a SIEM dashboard and triages incoming alerts against defined playbooks. Distinguishes known false positive patterns from genuine threats. Escalates confirmed incidents to Tier 2 analysts with a clear summary of the evidence. Understands the MITRE ATT&CK framework at a conceptual level.

Intermediate

Investigates complex multi-stage attacks across endpoint, network, and identity data sources. Writes and tunes SIEM detection rules to improve signal quality. Uses threat intelligence to contextualise alerts with actor attribution and campaign context. Contributes to post-incident analysis and detection improvement. Conducts threat hunting exercises to proactively search for undetected threats.

Expert

Designs the detection architecture for a SOC — selecting tools, building the data pipeline, defining detection priorities aligned to the organisation's threat model, and establishing the operating procedures. Leads threat hunting programmes. Develops custom detection logic for advanced persistent threats targeting the organisation's sector. Contributes threat intelligence to industry sharing communities (ISACs).

How to Practise

1.Set up a home lab SIEM (using the free tiers of Elastic SIEM or Microsoft Sentinel) and ingest logs from a virtual machine — practise writing detection rules for common attack techniques and investigating the alerts they generate.
2.Work through MITRE ATT&CK tactics systematically — for each tactic (Initial Access, Execution, Persistence...) understand what attacker behaviour looks like, what logs would capture it, and what a detection rule would look like.
3.Complete CTF (Capture the Flag) competitions and platforms (TryHackMe, HackTheBox, Blue Team Labs Online) — these provide realistic threat detection and investigation scenarios with guided learning paths.
4.Practise log analysis: take a sample of Windows event logs, Linux auth logs, or web server access logs and manually identify anomalous entries that could indicate attack activity.

How to Prove

·CompTIA Security+ or CompTIA CySA+ certification — widely recognised entry-level and analyst-level cybersecurity qualifications.
·GIAC GCIA (Intrusion Analyst) or GCIH (Incident Handler) — specialist certifications for threat detection and incident response.
·SOC analyst employment record — demonstrating live experience handling security alerts in an operational environment.
·TryHackMe or HackTheBox completion certificates — demonstrating practical threat detection and analysis skills.