C1000-162 splits into five weighted domains, and threat hunting takes the largest share at 24 percent. Here is how the marks sit, what the exam expects from an analyst at the console, and how it differs from the QRadar foundations and administration papers.