Process and analysis
What is Threat hunting?
Proactively searching your own data for signs of attackers that existing alerts have missed, usually starting from a hypothesis.
Threat hunting is the proactive search for malicious activity that existing detections have not caught. A hunt usually starts from a hypothesis, often informed by threat intelligence, such as "an actor targeting our sector uses scheduled tasks for persistence; do we have any unexplained ones?"
The hunter queries telemetry, investigates anomalies and either finds an intrusion or confirms the hypothesis was not borne out. Either way, good hunts end by turning what was learned into a new detection.