What makes a hunt useful
A proactive hunt begins with a qualified security question that can be tested against available evidence. The hypothesis should state the suspected behavior, relevant entities or scope, expected evidence, time window, and the result that would justify further investigation.
Start a hunt with a specific question, time range and search scope so another analyst can repeat and review it.
Follow the hunt lifecycle
-
01
Qualify
Connect the hypothesis to an alert pattern, threat context, behavioral change, exposure, or coverage question.
-
02
Plan
Define scope, time, sources, expected fields, exclusions, and completion criteria.
-
03
Search
Search the relevant events within the chosen time range and record what data was covered.
-
04
Validate
Review matches in source context, compare recurrence, and separate supported findings from unknowns.
-
05
Conclude
Record the outcome, evidence, gaps, recommended investigation, and any detection-coverage proposal.
Understand the outcome
A hunt can find supported activity, find no matching activity in the assessed evidence, remain inconclusive, or expose a coverage gap. No matches do not prove absence when required sources are missing, stale, outside retention, or unsupported.
Proactive hunting does not autonomously create alerts, prove a detection gap, or execute remediation. Analyst validation and the applicable governance path remain required.