University

Threat hunting university

A glossary and nine lessons for analysts new to hunting and teams choosing a tool.

First shift

What a hunt is, where its data comes from and the two ways to start one.

Lesson 1 · 3 min read
Threat hunting versus alert triage: where a hunt starts
Triage starts with an alert; a hunt starts with a question. What each produces and how they feed each other.
Lesson 2 · 3 min read
Threat hunting data sources: the six a hunt reads
SIEM, EDR, identity provider, cloud logs, data lake and SaaS apps: what each one shows a hunter.
Lesson 3 · 3 min read
IOC vs TTP hunting: indicators and behaviors
Sweeping for known indicators is fast and narrow; hunting for behaviors lasts longer and takes more work.

From a written hypothesis to a logged result and a tested rule.

Lesson 4 · 2 min read
Writing a hunt hypothesis
A behavior, a place, a time frame and the data that would prove or disprove it.
Lesson 5 · 2 min read
Reading an ATT&CK tactic page
The tactic ID, the technique list, sub-techniques, detection notes and data sources.
Lesson 6 · 3 min read
Keeping a threat hunt log: what to record for every hunt
What to record for every hunt so the next shift can repeat it, report it and build on it.
Lesson 7 · 2 min read
From hunt to detection rule
Generalize the query, add context, test it against past data, review it and deploy it with an owner.

Check your own data and priorities before a shortlist.

Lesson 8 · 2 min read
Map your security data before shortlisting a threat hunting tool
List your own sources, retention and access first, then check each tool's named sources against them.
Lesson 9 · 3 min read
Setting your own weights for threat hunting tool scores
How our seven weights are set, when to change them, and how to read the calculator's result.