Threat Hunting

Threat hunting is the active search for adversary activity that automated detection has not already flagged. A hunter starts from a hypothesis about how an attacker could operate in a specific environment, then tests that hypothesis against telemetry from endpoints, identities, network flows, and logs.

Detection and hunting share tooling and data, but they differ in direction. Detection waits for an alert; hunting goes looking. Detection answers "what did my rule fire on?"; hunting answers "if an adversary used this technique here, what would it look like, and is it present?" A mature security operations program uses both: detection for known patterns at scale, hunting for the gaps and the novel.

Why hunting exists

Alerts are reactive and incomplete. Defenders face adversaries who adapt, use legitimate credentials and tools, and avoid signatures. Telemetry that detectors require often exists but is not wired to a rule. Hunting exists to close that gap by combining adversary knowledge, environment knowledge, and analytic questions before an incident forces the question.

A hunt does not replace incident response. When a hunt confirms malicious activity, it hands off to responders who scope, contain, and recover. When a hunt confirms benign activity, it still leaves value: a documented analytic, a refined baseline, and a detection that can fire the next time.