Home / Knowledge hub / Threat hunting
Knowledge hub
Threat hunting
Searching your systems for attackers that alerts have not yet caught.
What it means
Threat hunting is the practice of searching your systems for signs of an attacker that your alerts have not found. Instead of waiting for a tool to raise an alarm, a person forms a theory about how an intruder might be hiding and looks in the data for evidence.
It begins from the assumption that some attacks will get past automated defences. A hunter picks a question, such as whether any service account is signing in at odd hours, searches logs for the answer, and records what was learned either way.
Why it matters
Attackers who get in quietly can stay for a long time, because nothing they do trips a rule. Hunting shortens that time by finding the activity that sits just under the alert thresholds, and reduces the damage from a breach discovered late.
Even when a hunt finds nothing, it is useful. It shows where logs are missing, which alerts are too noisy and which parts of the network nobody watches. Each hunt can be turned into a permanent detection rule, so the next attempt is caught automatically.
How it shows up
A hunt is built around a hypothesis, often drawn from the MITRE ATT&CK framework or from a recent incident. The hunter searches data in the SIEM and endpoint tools for indicators of compromise and unusual behaviour, then follows up anything odd.
It needs good data first. Without logs, you cannot hunt. The mistakes repeat: hunting with no clear question, treating it as a one-off, or finding something and not recording the method. A small team can start with one hunt a month on a question that matters to the business, and write down the result.
Questions people ask
Threat hunting, answered
Is threat hunting the same as incident response?
No. Hunting looks for attackers before an alert, while incident response reacts once a problem is known. A hunt that finds something hands over to incident response, which then contains and investigates.
Do we need a security operations centre to hunt?
Not necessarily, but you need good logs and someone with time and skill. Small teams can run simple hunts using the logs they already collect, as long as someone has set time aside.
What tools does threat hunting use?
Usually a SIEM and endpoint or network telemetry, plus threat intelligence. Tools matter less than data quality and clear questions, since a hunt with poor data finds little however good the tool.
How is it different from monitoring and alerting?
Monitoring runs automatically against fixed rules. Hunting is a human, hypothesis-led search that looks for what the rules miss, and its findings often become new rules, so the same behaviour is caught automatically next time.
What if a hunt finds nothing?
That is a valid result. It tells you the behaviour you searched for was not present, and shows where your data is thin. Record it and move on to the next question.
Sources
Where this comes from
Related
Terms that sit next to this one
Indicators of compromise
Traces, such as addresses or file hashes, that suggest a system has been breached.
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
MITRE ATT&CK
A public catalogue of the tactics and techniques real attackers use.
Incident response
The agreed plan for the hours after something has gone wrong.
Security operations centre
A team and room that watch for and respond to threats around the clock.
What would a quiet intruder leave?
Hunters work from evidence in your logs. When we find a flaw we show the exact request that exploited it, which tells defenders what that activity looks like. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.