Threat hunting versus alert triage: where a hunt starts

A night shift in a security operations center usually has two kinds of work on the board. One is the queue: alerts that detections have already raised, waiting for someone to decide what they mean. The other is the work nobody asked for yet: looking for activity that no rule caught. The first is alert triage. The second is threat hunting. They use the same data and often the same people, but they start in different places.

What does triage start from?

Triage starts from an alert. A rule matched something, and an analyst has to answer three questions: is it real, how serious is it, and who acts next. The work is reactive by design. It depends on the rule having been written, the data having arrived and the alert having been routed to the right queue. When any of those fail, triage never begins, because there is nothing in the queue.

What does a hunt start from?

A hunt starts from a question. There are three common sources.

1. Intelligence. A new advisory, report or indicator list describes an attack, and the hunter asks whether any of it appears in the environment. Several tools in our ranking turn this step into an automated pipeline.
2. A hypothesis. The hunter writes down a specific behavior they suspect, where it would happen and what data would show it. See writing a hunt hypothesis.
3. A departure from normal. Something differs from the baseline: a host that talks to a new destination, a log source that went quiet, an account that signs in at an unusual hour.

In every case the hunt assumes that existing detections might have missed something. That assumption is the whole point. A hunt that only repeats what the rules already check adds little.

What should a hunt produce?

A hunt that ends with "nothing interesting" and no record is lost work. A useful hunt ends in one of four results.

• A finding. Evidence of malicious or unexplained activity, handed to incident response as a case.
• A documented negative. The hypothesis was tested on a stated window of data and not supported. That is a result, and it tells the next hunter where not to spend time.
• A new detection. The behavior can be spotted reliably, so the hunt query becomes a rule. See from hunt to detection rule.
• A data gap. The hunt could not be answered because a source was missing, too short in retention or unreachable. That gap goes to whoever owns the data.

How do the two connect?

Hunting and triage feed each other. Good hunts create rules, and those rules create alerts that triage handles. Triage, in turn, surfaces patterns worth hunting: a false positive that keeps returning may hide a real technique that looks similar. The link between them is the detection library, which is why most tools in this guide cover both hunting and detection engineering.

Vendors describe the hand-off differently. Mars Security's hunting guide says its hunts hand analysts "a corroborated shortlist rather than a scored queue". Artemis Security describes autonomous investigation where response actions wait for human confirmation. Both descriptions are about the same boundary: where automated work stops and an analyst's judgment starts.

A quick test

If you are unsure which kind of work a task is, ask what started it. If an alert started it, it is triage. If a question started it, it is a hunt, and it deserves a written hypothesis and a record of the result.