Hello Reader,
Let me introduce me first, I am Sai Krishna Raman working as a Security Analyst in SOC in a Cloud Environment where my primary responsibilities include Incident Response, Threat Hunting and usual SOC duties.
Although working in the domain of threat hunting for quite a time now, I always wanted a certification on my profile which will challenge, enhance my skills and ofcourse which I can afford.
After a lot of research, I found GCFA(SANS), OSTH(Offsec), BTL2(Security Blue Team) and eCTHP(INE) certifications, which are well reputated/respected in Cyber Security Community with regards to Threat Hunting.
I always wanted to earn GCFA(I will in future) which will show my capabilities,expertise in Advanced Threat Hunting & Digital Forensics, so I started with eCTHP which will act as a solid base for the skillset that I am looking for. So, I decided to peruse eCTHP. I bought the voucher from INE and started preparing for the exam.
PREPARATION:
I started preparing for the exam by going through the content of Threat Hunting Professional Path, doing labs, quizzes and researching about the external references provided by the INE in the course content.
THREAT HUNTING PROFESSIONAL PATH CONTENT:
This path contains 3 sections, 6 courses, 10 labs and 54 quizzes which are sufficient to clear the exam.
Sections and Courses include:
Introduction to threat hunting, Intelligence in threat hunting Threat Hunting Strategies Network Threat Hunting(wireshark, tcpdump, redline, IOC editor etc) Endpoint Threat Hunting(Splunk, ELK) EXAM PATTERN:
Exam consists of 60 questions which will include multiple choice questions and labs where you need to perform actual threat hunt on a network, to identify the malicious/suspicious behaviours exhibited by the threat actors within give time frame(10 hours). Yes, you will have 10 hours to perform an actual threat hunt on a network using different tools.
You need to score 70% minimum to pass the exam.
STRATEGY FOR THE EXAM:
Prepare your own notes(online/offile) as exam is openbook, so that you can refer to them whenever required, focus more on WireShark, Splunk and ELK where you will perform an actual threat hunt to uncover the threats. Below are sample scenarios you can face in the exam.
Example Scenario Wireshark:
You will be asked to Extract the encryption key from the packet and decode it using decoders available online and use that key to uncover the obfuscation techniques used by attacker.
Example Scenario Splunk & ELK:
Identify the malicious service used by the attacker, which was used to make changes to the registry or uncover the patterns(connecting the dots) how attacker has moved laterally using legitimate services,you will see all those logs.
EXAM:
After completing the whole path, I felt confident and decided to give the exam on a fine evening. Started exam with completing multiple choice questions, then moving to Splunk, ELK and then to Wireshark.
Completed Splunk/ ELK within no time as I already have experience using Splunk, which were challening but not quite tough, took more time to solve the questions of Wireshark as it was bit challenging to decode every packet with labs connectivity too slow.
After reviewing every question twice, submitted the exam, got the results instantly and passed the exam with flying colours.
I passed eCTHP on 10th September 2025, here is my Cerification Snap, you can verify this here https://certs.ine.com/ca4da38e-67e7-42ac-917a-97d64fef1f19#acc.fxIqJtD