Threat hunting data sources: the six a hunt reads

This site's data source grid sorts what each tool's public pages name into six source types. The same six types are a useful way to plan a hunt, because each one sees a different part of an attack.

SIEM

The SIEM collects logs from many systems, keeps them for a set retention period and runs detections over them. For a hunter it is often the first stop, because it already holds several sources in one place and the team knows its query language. Check two things before relying on it: which sources actually flow into it, and how far back retention goes for each.

A hunt question it answers well: "Which hosts produced authentication failures followed by a success from the same source within ten minutes?"

EDR

Endpoint detection and response software records what happens on laptops and servers: processes started, files written, network connections made. It is the main source for behavior on a machine, such as Execution and Persistence in ATT&CK terms.

A hunt question: "Which processes started from a user's downloads folder and then made an outbound connection?"

Identity provider

The identity provider records sign-ins, multi-factor prompts, password resets and role changes. Many attacks that never touch malware still leave traces here, which makes it central to hunts for credential theft and account misuse.

A hunt question: "Which accounts approved several multi-factor prompts in a short period after a series of denials?"

Cloud logs

Cloud provider logs record control-plane activity: who called which API, when and from where. AWS CloudTrail is a common example. They show changes to permissions, new access keys, disabled logging and resources created in unusual regions.

A hunt question: "Which identities created new access keys for other identities in the last 30 days?"

Data lake or warehouse

Teams increasingly keep high-volume or long-retention security data in a data lake or warehouse, such as Snowflake or Databricks. It is where long look-backs happen, because keeping a year of data there can be practical when it would not be elsewhere.

A hunt question: "Did any host contact this newly published domain at any time in the last year?"

SaaS apps

Business applications keep their own audit logs: file sharing, admin changes, mailbox rules, repository access. These are easy to forget and often hold the evidence of data theft.

A hunt question: "Which users created external sharing links for many files in one day?"

Joining the sources

Real hunts cross these lines. An account signs in from a new country (identity), then a process runs on a laptop (EDR), then a large download follows (SaaS). Each system names the user and the host in its own way: an email address in one, a username in another, a device ID in a third. Before a cross-source hunt, write down which field identifies the same entity in each source. That mapping is where most time goes.

What to record for each source

• The platform name and who owns access.
• Retention: how far back you can look.
• The query language.
• Whether tools will query it in place or copy it first. See federated search.

The next lesson covers the two ways to use these sources: hunting for indicators and hunting for behaviors.