Detection tools only catch what they have been told to look for. Threat intelligence supplies that knowledge: who attackers are, what tools and techniques they use, and what traces they leave behind. Threat hunting then turns it around, with analysts searching their own environment for attackers that the alerts have missed.
You'll start with threat intelligence and the different kinds of intelligence a security team uses. Then you'll look at indicators of compromise and the Pyramid of Pain, which shows why some indicators are far more useful than others, learn the fundamentals of threat hunting, and finish with a hands-on hunt that starts from a hypothesis and maps what it finds to MITRE ATT&CK.
Once you're comfortable here, move on to Incident Response & Forensics to learn what analysts do once a real threat has been confirmed.
What threat intelligence is and why organisations use it, including the strategic, tactical, and operational types and how each helps prevent attacks.
How threat indicators are ranked by how much it hurts an attacker when you detect and block them, from file hashes and IP addresses up to the techniques an attacker relies on.
What threat hunting means, how it differs from waiting for alerts, and how analysts go about finding modern attacks that have slipped past automated defences.
A practical crash course in hunting: forming a hypothesis, searching the data with Velociraptor and Splunk, and mapping the findings to MITRE ATT&CK.