What is Threat Hunting?

Reactive SOC operations wait for an alert to fire before an analyst looks at anything. Hunting inverts that: instead of waiting, the hunter forms a hypothesis, grounded in threat intelligence, known attacker TTPs, or something odd noticed during routine work, and actively searches data for evidence supporting or refuting it, whether or not any alert has fired. A hypothesis might be as specific as: APT29 has been observed using Cobalt Strike beacons with a particular HTTP header pattern and jitter interval, so search proxy logs across all egress points for that pattern. Or it might be as broad as: service accounts should never interactively log onto workstations, so surface every case where one did in the last 30 days.

The hunt cycle has a consistent shape: form the hypothesis, identify what data would prove or disprove it and where that data lives, query and pivot through it, and reach a conclusion. A null result, no evidence found, is still a valuable outcome; it validates that a specific attacker behavior is not present, which narrows the threat model. A positive finding gets handed to incident response with the supporting evidence and query logic documented so the detection can potentially be automated into a standing alert, closing the loop from one-off hunt to permanent coverage.

Effective hunting depends on infrastructure most organizations underinvest in: broad telemetry collection with long retention, since you cannot hunt through data that was never collected or was purged after a week; analysts with deep knowledge of both attacker technique and what normal looks like in this specific environment, since a query result is meaningless without the context to interpret it; efficient query tooling that lets an analyst pivot across data sources quickly rather than waiting minutes per search; and organizational buy-in to fund analyst time on work that, by design, mostly produces negative results.

Hunting differs from incident response in timing and posture: IR reacts to a confirmed or suspected incident, while hunting proactively looks for incidents nobody has flagged yet. It differs from routine alert triage in depth: triage evaluates what an automated rule already found, while hunting builds and tests its own hypotheses from scratch.