What Is Threat Hunting?

On this page
  1. How does a hunt work?
  2. Hunting vs alerting

Threat hunting proactively searches for attackers who have slipped past automated detection — instead of waiting for an alert that may never fire. It starts from an uncomfortable but realistic assumption: a determined adversary may already be inside, quietly avoiding the rules you wrote. The hunter’s job is to go look, guided by hypotheses about how such an adversary would behave.

How does a hunt work?#

Threat hunting is hypothesis-driven, not random:

  1. Hypothesize — “if an attacker were doing X, we would see Y.” Often anchored to a MITRE ATT&CK technique relevant to your threats.
  2. Investigate — examine logs, EDR telemetry, and network data for Y.
  3. Prove or disprove — find the activity, or gain confidence it is not there.
  4. Operationalize — turn a successful hunt into a new detection rule.

That last step matters: hunting is not just finding today’s intruder, it is discovering the gaps in your automated detection and closing them.

Hunting vs alerting#

AlertingThreat hunting
Reactive — waits for known patternsProactive — seeks the unknown
AutomatedHuman-driven, hypothesis-led
Catches what rules coverCatches what rules missed
StaticFeeds new rules back

Threat hunting is the proactive edge of detection. More at the Defense & Hardening hub.

Frequently asked questions#

What is threat hunting?

Threat hunting is the proactive practice of searching an environment for signs of attackers who have evaded automated detection, instead of waiting for alerts to fire. Hunters form hypotheses about how an adversary might operate, then examine data to prove or disprove them — assuming a breach may already exist and looking for it.

How is threat hunting different from alerting?

Alerting is reactive: predefined rules fire when known-bad patterns appear. Threat hunting is proactive and human-driven: it looks for the unknown, the subtle, and the novel that no rule was written for. Successful hunts often become new detection rules, feeding the automated layer with what humans discovered.

Sources & further reading