Field note · Logged September 2026
Threat hunting without adding headcount
What automation can take off a small team, and what it cannot.
Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18
About 2 minutes
Which parts of hunting can a tool automate?
| Task | Can be automated? | Notes |
|---|---|---|
| Reading new threat reports and extracting behaviors | Yes | Mars Security, Nebulock, Cotool and Artemis Security all describe this. |
| Writing the hunt queries for each data source | Largely | Mars writes queries in each source's native language; Vega and Artemis accept plain-language hunts. |
| Running hunts continuously | Yes | The core of hunt automation (criterion HNT). |
| Triaging results into a short list | Partly | Mars describes a "corroborated shortlist"; Artemis investigates autonomously with human-confirmed actions. |
| Testing a new detection against past data | Yes | Backtests (Mars, 30 days) and retrohunts (Nebulock). |
| Choosing which hypotheses matter | No | Depends on knowing the business and its risks. |
| Deciding what a finding means and what to do | No | Tools can gather evidence; the decision stays with people. |
Which tools score highest for a small team?
Rank by the two criteria that matter most when there is no dedicated hunter: hunt automation (HNT) and analyst effort saved (EFF).
| Tool | Hunt automation (HNT) | Analyst effort saved (EFF) | Total |
|---|---|---|---|
| Mars Security | 9 | 8 | 7.45 |
| Nebulock | 9 | 8 | 7.45 |
| Artemis Security | 8 | 9 | 6.75 |
| Cotool | 8 | 8 | 7.10 |
| Vega | 8 | 8 | 7.00 |
| Anvilogic | 6 | 8 | 7.30 |
| CardinalOps | 4 | 6 | 5.60 |
What does a tool need from you?
- Access to the data: read access to SIEM, EDR, identity and cloud logs. Tools that query in place avoid a data migration project.
- A short list of priorities: the systems and threats that matter most.
- An owner for detections: someone who accepts, tunes or retires what the tool proposes.
- Time to review: even automated hunts need an hour or two a week of human review.
What are the risks of hunting on autopilot?
- Only hunting what is in the news. Intelligence-driven hunts miss threats specific to your environment; keep some hypothesis-driven hunts.
- Accepting every generated detection. Unreviewed rules add noise.
- Losing track of coverage. Record what has been hunted against ATT&CK so gaps stay visible.
Frequently asked questions
Can one analyst run a threat hunting program?
With automation handling intelligence-driven hunts and first-pass triage, one analyst can review results and run a small number of hypothesis-driven hunts each week. Coverage will still be narrower than a dedicated team's.
How do I automate detection engineering without more headcount?
Use a tool that writes and tests rules from intelligence or hunt findings (for example Mars Security, Nebulock, Anvilogic or Cotool), keep rules in version control, and have one owner review what ships.