Threat Hunting

Rather than waiting for alerts to trigger, threat hunters use hypotheses based on attacker TTPs, threat intelligence, and environmental anomalies to look for signs of compromise that detection tools may have missed. Threat hunting is typically performed by senior L3 analysts and complements reactive alert investigation by uncovering stealthy, long-dwell threats. It requires deep knowledge of the environment, attacker behavior, and data sources.