Threat hunting proactively searches for threats that evade automated detection, using human analysis and hypothesis-driven investigation.
What is Threat Hunting?
Unlike reactive security, threat hunting assumes adversaries may already be present and actively searches for indicators of compromise.
Hunting Process
- Hypothesis - Form theories about potential threats.
- Investigation - Search data for supporting evidence.
- Resolution - Confirm or refute hypothesis, take action.
Hunting Tools
Threat hunting leverages SIEM, EDR, and threat intelligence to search for indicators.
Hunt with Intelligence
Use threat feeds to develop hunting hypotheses.