Threat hunting is a proactive search through logs and systems for intruder activity that automated alerts did not already surface.
Hunters begin with a hypothesis and a time box, then turn confirmed findings into detections for the next time.
How it works
The assumption is that some intrusions blend into normal activity and never raise an alert.
Analysts look for rare tools, unusual logons, and data movement outside the patterns the business expects.
A hunt that never updates detections becomes a repeated manual chore.
The logging pipeline itself must be protected, or an intruder can erase the evidence the hunt needs.
Concrete examples
- An analyst searches servers for a remote administration tool the company does not use.
- A hunter reviews privileged logons that appear from a country the account never used.
- A team looks for archive files created outside the normal backup window.
Protective measures
- Keep centralized logs long enough that a hypothesis can actually be searched.
- Write the hypothesis and the time box before the hunt starts.
- Convert a confirmed finding into a detection so it is not hunted forever by hand.
- Protect the logging path so an intruder cannot quietly delete the record.