University

Threat hunting glossary

Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18

A

Advisory: A published warning about an active threat, usually from a government agency, a vendor research team or an incident response firm. Advisories are a common starting point for intelligence-driven hunts.
Agile release (ATT&CK): MITRE's narrower-scope release format for ATT&CK. MITRE's updates page dates v19.2 to 6 August 2026 and describes it as the first release in this format.Source: attack.mitre.org/resources/updates
Alert triage: Deciding whether a fired alert is real and how urgent it is. Reactive, unlike threat hunting.
Atomic detection: A rule that matches a single suspicious event.
ATT&CK (MITRE ATT&CK): A public knowledge base of adversary tactics and techniques, maintained by MITRE. The Enterprise matrix has 15 tactics as of v19.2. See MITRE ATT&CK coverage. See also: what ATT&CK v19 changes.Source: attack.mitre.org

Backtest: Running a new rule against past data before it goes live to see what it would have caught.
Baseline: A description of normal activity for a user, host or system, used to spot anomalies.

Correlation detection: A rule that matches a pattern across several events over time.
Corroborated finding: A hunt result supported by evidence from more than one source, such as an identity sign-in and an endpoint process that point to the same activity. Corroboration is what separates a lead from noise.
Coverage gap: An ATT&CK technique, or a data source, that no deployed detection or hunt addresses.
Coverage view: A display, often a heatmap, that shows which ATT&CK techniques have deployed detections or hunts and which do not. It shows mapping, not proof that each rule works.

Data lake: A store for large volumes of raw data, such as Snowflake or Databricks, that hunting tools can query in place alongside the SIEM.
Data source inventory: A list of every security data source a team runs, with where it is stored, how long it is kept and how it is queried. See mapping your data before a shortlist.
Defense Impairment (TA0112): An ATT&CK Enterprise tactic created on 14 April 2026, covering adversary efforts to undermine security mechanisms and monitoring. It was split out of the former Defense Evasion tactic in ATT&CK v19.Source: attack.mitre.org/tactics/TA0112
Detection drift: A detection that silently stops working because something upstream changed, such as a field name, log format or pipeline.
Detection engineering: The discipline of designing, testing, deploying and maintaining detection rules. See what is detection engineering.
Detection rule: Logic that runs continuously over incoming data and raises an alert when it matches. A good rule has a stated purpose, an owner and a test record.
Detection Rule License (DRL): The license under which the Sigma project publishes its rules. The Sigma repository states version 1.1.Source: github.com/SigmaHQ/sigma
Detection-as-code: Managing detection rules in version control with review, tests and automated deployment. See detection-as-code explained.

EDR (endpoint detection and response): Software on endpoints that records activity and can act on threats; a key hunting data source.

False positive: An alert or hunt result that looks malicious but is not.
Federated search: Querying data where it is stored, across several systems, instead of copying it into one place first.

Hunt fit score: This site's editorial score from 0 to 10 for how well a tool suits continuous threat hunting and detection engineering on data a team already has. It is a weighted total of seven criteria; see the scoring method.
Hunt hypothesis: A specific, testable statement about attacker behavior that a hunt sets out to prove or disprove. See hypothesis-driven hunting.
Hunt log: The written record of each hunt: hypothesis, ATT&CK tags and version, data and time window, queries, results and outcome. See keeping a hunt log.
Hunt playbook: A saved, repeatable hunt: the hypothesis, the queries for each data source and the steps for judging results.

Indicator of compromise (IOC): An artifact such as an IP address, domain or file hash associated with malicious activity.
Ingestion: Copying data into a platform's own storage before it can be searched.
Intelligence-driven hunt: A hunt that starts from a threat report, advisory or indicator set.

MCP (Model Context Protocol): An open protocol that lets AI agents connect to tools and data. Several vendors here support it for integrations.Source: modelcontextprotocol.io

Native query language: The query language a data platform uses itself. A cross-source hunt has to be expressed in each platform's language, either by the analyst or by a tool that translates it.

OCSF (Open Cybersecurity Schema Framework): An open schema for normalizing security events so that data from different products shares field names. Artemis Security, for example, normalizes some events it ingests to OCSF.

Proof of concept (POC): A time-boxed trial of a tool on a team's own data, with success criteria agreed in advance. See how to run a proof of concept.
pySigma: A Python library from the Sigma project that converts generic Sigma rules into the query languages of specific platforms. The project also offers the Sigma CLI for the same job.Source: github.com/SigmaHQ/sigma

Retrohunt: Running a detection or hunt query back through past telemetry. Nebulock requires one before a rule deploys.

SIEM (security information and event management): The platform that collects security logs and runs detections. The tools in this guide read from or deploy into it.
Sigma: An open, generic signature format for log-based detection rules, with converters to platform query languages.Source: github.com/SigmaHQ/sigma
Stealth (TA0005): The ATT&CK Enterprise tactic formerly named Defense Evasion, renamed in ATT&CK v19 when Defense Impairment became a separate tactic. It covers techniques adversaries use to avoid being noticed.Source: attack.mitre.org/tactics/enterprise
STIX and TAXII: Two related standards for sharing threat intelligence: STIX describes intelligence objects, and TAXII defines how they are exchanged between systems. Some hunting tools accept custom intelligence in these formats.
Sub-technique: In ATT&CK, a more specific variant of a technique, shown with a dot and a number after the technique ID.Source: attack.mitre.org/techniques/enterprise

Tactic: In ATT&CK, the adversary's goal at a stage of an attack, such as Credential Access.Source: attack.mitre.org/tactics/enterprise
Technique: In ATT&CK, how an adversary achieves a tactic, such as a specific way of stealing credentials.Source: attack.mitre.org/techniques/enterprise
Threat intelligence: Information about adversaries, their tools and their behavior, used to decide what to hunt and detect. It ranges from indicator lists to detailed accounts of how an intrusion unfolded.
TTP (tactics, techniques and procedures): A description of how an adversary operates; hunting for TTPs targets behavior rather than indicators.Source: attack.mitre.org

Editorial assessment · From vendor product pages, docs and announcements · Updated 2026-10-18