300-220 CBRTHD: Cisco Threat Hunting and Defending

300-220 CBRTHD is Cisco's current professional concentration exam for threat hunting and defensive cybersecurity operations. It tests the ability to build a hunt from a threat hypothesis, select useful telemetry, search for attacker behavior, validate findings and convert the result into stronger detections or response actions.

Passing 300-220 earns the Cisco Certified Cybersecurity Specialist – Threat Hunting and Defending credential and can satisfy the concentration requirement for CCNP Cybersecurity. Cisco lists it as a 90-minute, US$300 exam, paired at the professional level with 350-201 CBRCOR.

Threat hunting is different from waiting for a SIEM alert. It starts from a reasoned suspicion about attacker behavior and asks whether the environment contains supporting evidence. Candidates coming from 200-201 CCNA Cybersecurity should keep their monitoring and incident-response foundations but add a more proactive, hypothesis-driven mindset.

A hunt needs a hypothesis that can be tested with available data

A useful hypothesis is specific enough to search for and important enough to justify the effort. “An attacker may be using compromised credentials to move laterally through remote-management services” is more actionable than “there may be malware.” The hypothesis should imply observable behavior, likely data sources and a way to decide whether the evidence supports it.

Practice turning threat intelligence or a recent incident into a hunt statement. Identify the technique, affected assets and expected traces. Then ask whether the organization actually collects those traces. A hunt that depends on unavailable telemetry is a data-quality problem before it is an analytics problem, and recognizing that limitation is part of mature threat hunting.

Threat modeling helps hunters decide where an adversary is likely to act

Threat hunting improves when analysts understand assets, trust boundaries, identities and attack paths. Threat modeling creates that structure. It does not predict one exact intrusion; it highlights where attacker objectives and system exposure intersect. Hunters can then prioritize behaviors that would matter most to the environment.

Use models to generate questions rather than static diagrams. If an application trusts a service account with broad access, ask what logs would show abuse of that identity. If administrators use a jump host, define what unusual movement would look like. The PrepAway article on threat modeling skills can extend that role context without replacing Cisco's exam objectives.

Telemetry selection determines what the hunt can prove

Endpoint events, authentication logs, DNS, network flows, packet captures, cloud audit logs and security-product telemetry answer different questions. Good hunters know which source is authoritative for a particular behavior and where blind spots exist. Collecting more data is not automatically better if timestamps, identity mapping or retention are unreliable.

For each hunt, list the minimum evidence needed to confirm the behavior and the secondary sources that can corroborate it. A suspicious login may need identity logs, endpoint activity and network context. This approach prevents overreliance on a single alert and makes the hunt more resilient when one source is incomplete.

Behavioral analytics are stronger than static indicators when attackers change infrastructure

IP addresses, domains and hashes can be useful, but they are easy for attackers to replace. Behavioral hunts look for sequences and techniques such as unusual credential use, abnormal process relationships, unexpected remote execution or staging before exfiltration. These patterns can survive changes in specific infrastructure.

Candidates should be able to express a behavior as searchable logic. That may involve process ancestry, authentication patterns, network timing or correlations across systems. The exact query language can vary by platform; what matters is understanding the data fields, expected baseline and conditions that distinguish suspicious activity from normal administration.

Attribution should be treated as a confidence problem, not a guess

The exam includes threat-actor attribution concepts because defenders often need to assess who might be responsible for an activity. Attribution is difficult and should be based on multiple dimensions such as infrastructure, tooling, behavior, targeting and historical intelligence. A single shared technique or malware family rarely proves identity.

Practice writing confidence-qualified assessments. State which observations support a relationship and which factors could produce false association. This habit reduces the risk of letting a compelling narrative outrun the evidence. In operational defense, the immediate containment decision often matters more than attaching a famous actor name to the event.

Hunting outcomes should improve detections and defensive controls

A hunt is not complete when an analyst finds something interesting. Results should become repeatable value: a new detection, a refined rule, additional telemetry, a playbook change, a hardening action or a documented reason to stop pursuing the hypothesis. Otherwise the organization repeatedly pays the cost of rediscovering the same behavior.

Track what the hunt searched, which data was used, how many results were reviewed, what was confirmed and what changed afterward. This creates a feedback loop between hunters, detection engineers and incident responders. It also provides evidence that hunting activity is driven by risk rather than by random exploration of logs.

Defending requires understanding how controls change attacker options

Threat hunters should understand preventive and detective controls well enough to interpret attacker behavior. Segmentation, identity controls, endpoint protection, application allowlisting and egress restrictions can force adversaries to change techniques. Those changes may create new detectable signals or explain why expected evidence is absent.

In a scenario, ask what the attacker would do if a particular control succeeds or fails. If PowerShell is constrained, another interpreter may appear. If direct outbound traffic is blocked, a compromised proxy or cloud service may be used. Defensive thinking is strongest when it anticipates adaptation rather than assuming controls produce a fixed attack path.

CBRTHD and CBRFIR emphasize different advanced security-operations skills

Cisco places both exams under the same professional cybersecurity path, but their center of gravity is different. 300-215 CBRFIR emphasizes forensic analysis and incident reconstruction; CBRTHD emphasizes proactive discovery, hunting process and defensive improvement. Many security teams need both capabilities, even when individuals specialize.

Candidates should choose study cases accordingly. For CBRTHD, begin before a confirmed incident exists. Form the hypothesis, select telemetry, build search logic, investigate outliers and document the result. If the hunt uncovers compromise, incident-response and forensic procedures then become relevant, but they are downstream from the hunting process.

Hunt design benefits from baselining because “rare” is only meaningful relative to normal behavior. An executable seen once may be suspicious on a tightly controlled server but ordinary on a developer workstation. The hunter should therefore consider asset role, user population, change windows and historical frequency before escalating an outlier. Good baselines reduce wasted investigation without turning unusual behavior into an automatic dismissal.

Mapping hunt observations to a framework such as MITRE ATT&CK can help teams organize coverage, but the framework should not replace evidence. A technique identifier is useful when it connects a behavior to likely data sources, related detections and defensive gaps. It becomes counterproductive when analysts label an event with a technique and stop asking whether the activity is actually malicious in their environment.

Hunting and detection engineering should form a loop. A successful hunt may reveal a stable pattern that can become a SIEM rule, endpoint analytic or telemetry requirement. After deployment, the new detection should be measured for false positives and adjusted. This is how a one-time investigation becomes a durable improvement rather than a report that is never used again.

Mature teams also deconflict hunts with approved administration, testing and red-team activity. An unusual remote tool can look exactly like malicious lateral movement if the hunter does not check change records or authorized exercises. Deconfliction does not mean trusting every administrative explanation; it means using operational context as evidence and documenting why an event was closed or escalated.

Hunt prioritization should consider both likelihood and potential impact. A low-frequency technique against a highly privileged identity may deserve attention before a noisy pattern on low-value lab systems. Candidates should practice explaining why one hypothesis should be investigated first when analyst time is limited. That decision should be tied to risk, not simply to whichever query returns the most unusual results.

Threat intelligence can seed a hunt with techniques, infrastructure or actor behavior, but intelligence should be adapted to local assets and telemetry. A report about a technique used against cloud identity systems is not useful if the organization has no relevant cloud service. The hunter translates external intelligence into environment-specific questions instead of copying indicators into searches without context.

Negative results also have value when the hunt was well designed. “No evidence found” should state which data sources were searched, what time range was covered and what blind spots remain. That prevents stakeholders from interpreting absence of evidence as proof that the behavior never occurred. Documented limitations are part of a credible hunt outcome.

Hunt notebooks should preserve query versions and analyst decisions. If a search changes halfway through an investigation, record what changed and why so results can be reproduced. Reproducibility matters when a finding becomes an incident or a detection rule because another analyst should be able to obtain the same evidence from the same data.

Finally, measure the usefulness of the hunt rather than the number of searches run. Useful outcomes can include confirmed malicious activity, a closed hypothesis with documented coverage, a new detection, a telemetry improvement or a hardening action. These measures keep threat hunting tied to defensive value instead of rewarding activity for its own sake.

Preparation should repeatedly move from hypothesis to measurable outcome

Use the current CBRTHD blueprint as the final checklist and build a small hunt library. Examples can include anomalous privileged logins, unusual remote execution, suspicious DNS patterns, staged archives or rare outbound destinations. For each hunt, record the hypothesis, data sources, search logic, triage method and final outcome.

The best preparation develops disciplined curiosity. A strong hunter challenges both the attacker hypothesis and the benign explanation, looks for corroborating evidence and knows when the available data cannot support a conclusion. That mindset is what turns threat hunting from ad hoc searching into a repeatable defensive capability.