What Is Threat Hunting?
On this page
Threat hunting proactively searches for attackers who have slipped past automated detection — instead of waiting for an alert that may never fire. It starts from an uncomfortable but realistic assumption: a determined adversary may already be inside, quietly avoiding the rules you wrote. The hunter’s job is to go look, guided by hypotheses about how such an adversary would behave.
How does a hunt work?#
Threat hunting is hypothesis-driven, not random:
- Hypothesize — “if an attacker were doing X, we would see Y.” Often anchored to a MITRE ATT&CK technique relevant to your threats.
- Investigate — examine logs, EDR telemetry, and network data for Y.
- Prove or disprove — find the activity, or gain confidence it is not there.
- Operationalize — turn a successful hunt into a new detection rule.
That last step matters: hunting is not just finding today’s intruder, it is discovering the gaps in your automated detection and closing them.
Hunting vs alerting#
| Alerting | Threat hunting |
|---|---|
| Reactive — waits for known patterns | Proactive — seeks the unknown |
| Automated | Human-driven, hypothesis-led |
| Catches what rules cover | Catches what rules missed |
| Static | Feeds new rules back |
Threat hunting is the proactive edge of detection. More at the Defense & Hardening hub.
Frequently asked questions#
What is threat hunting?
Threat hunting is the proactive practice of searching an environment for signs of attackers who have evaded automated detection, instead of waiting for alerts to fire. Hunters form hypotheses about how an adversary might operate, then examine data to prove or disprove them — assuming a breach may already exist and looking for it.
How is threat hunting different from alerting?
Alerting is reactive: predefined rules fire when known-bad patterns appear. Threat hunting is proactive and human-driven: it looks for the unknown, the subtle, and the novel that no rule was written for. Successful hunts often become new detection rules, feeding the automated layer with what humans discovered.