CCFH — CrowdStrike Certified Falcon Hunter
CrowdStrike's advanced threat hunting certification covering hypothesis-driven hunting, CrowdStrike Query Language (CQL), behavioral analysis, and adversary intelligence-driven hunting within the Falcon ecosystem. Updated in 2024-2025 to reflect the shift from Splunk syntax to CQL as Falcon's native query language. Pure MCQ exam with one free retake. Not DoD 8140 approved. For threat hunters operating in CrowdStrike-heavy environments this is a meaningful advanced credential. The MCQ format is a particularly notable weakness for a hunting certification — actual hunting skill requires practice, not memorization. Pair with OSTH or GCTI for a more comprehensive hunting credential stack.
| Issuer | CrowdStrike |
|---|
| Level | expert |
|---|
| Domains | Defensive Security / SOC |
|---|
| Practical weight | 0% |
|---|
| Cost (USD) | 250 |
|---|
| Renewal | 3 years |
|---|
| Skills | threat_hunting_falcon, crowdstrike_query_language, behavioral_hunting, ttp_based_hunting, threat_graph_hunting, adversary_intelligence_driven_hunting, hunt_documentation |
|---|
Official certification page
Browse all 426 cybersecurity certifications on EBCertMap