I’m allocating Q1 spend and need a course that directly sharpens threat analysis and detection engineering — ideally with ATT&CK-aligned labs and metrics we can bring back to tune Sigma rules and EDR detections; under $2k would be ideal. Has anyone compared SANS SEC555 vs hands-on options like Practical Threat Hunting or vendor-agnostic detection engineering tracks for measurable gains (e.g., cutting MTTD by 20%+)?