Field note · Logged September 2026
What is threat hunting?
A working definition, and how hunting differs from alert triage.
Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18
About 2 minutes
How is threat hunting different from responding to alerts?
Alert triage is reactive: a rule fires, and an analyst decides whether it matters. Hunting is proactive: the analyst assumes something may already have been missed and goes looking. The two share data and skills, but they answer different questions. Triage asks 'is this alert real?' Hunting asks 'what is happening here that no alert told us about?'
What are the common types of threat hunt?
| Type | Starts from | Example |
|---|---|---|
| Hypothesis-driven | A statement about attacker behavior that can be tested | "A service account is being used interactively from a workstation." |
| Intelligence-driven | A new threat report, advisory or indicator set | A published campaign that abuses a remote management tool |
| Anomaly-driven | Something unusual in baselines | A spike in authentication failures against one application |
Most programs mix all three. Intelligence-driven hunts are the easiest to automate, because the starting point arrives in writing. Hypothesis-driven hunts depend most on analyst judgment; see hypothesis-driven hunting.
What does a hunt produce?
Three things. A finding, if the activity is there. Evidence that it is not, which is still useful because it narrows the question. And, ideally, a detection: a rule that runs from then on so the hunt does not have to be repeated by hand. That last step is where threat hunting hands work to detection engineering.
Where does MITRE ATT&CK fit?
ATT&CK gives hunters a shared vocabulary for attacker behavior. Its Enterprise matrix, version 19.2 at the time of writing, organizes techniques under 15 tactics, from Reconnaissance to Impact. Hunters use it to frame hypotheses ('look for Lateral Movement using remote services') and to record what a program has and has not looked for. See MITRE ATT&CK coverage.
Source: attack.mitre.org · Reviewed Sep 2026
What do threat hunting tools automate?
The tools in this guide automate different parts of the loop. Some read new intelligence and write the hunt for you (Mars Security, Nebulock, Cotool, Artemis Security). Some take a hypothesis in plain language and run it across sources (Vega, Nebulock). None removes the need for someone to decide which questions matter. See the ranking.