What is threat hunting in cybersecurity?

Threat hunting is the practice of manually searching logs, endpoint data, and network traffic to find attackers who bypassed automated defenses. It is hypothesis-driven and analyst-led, not alert-driven.

How is threat hunting different from incident response?

Incident response begins after an alert or confirmed breach. Threat hunting begins before any alert exists, with the goal of finding intrusions that have not yet triggered a detection.

What skills does a threat hunter need?

Threat hunters need strong knowledge of attacker techniques, familiarity with frameworks like MITRE ATT&CK, and the ability to write queries against log and endpoint data. Experience with SIEM, EDR, or XDR platforms is common.

How often should organizations conduct threat hunts?

Most security teams run hunts on a regular cadence, such as weekly or monthly, and also trigger targeted hunts after new threat intelligence about relevant adversary techniques becomes available.

What is Threat Hunting?

Threat Hunting is the practice of proactively searching through networks, endpoints, and logs to find attackers who have evaded automated detection. It is analyst-led work, driven by hypotheses about how an attacker might behave, not by alerts.

What it is

Threat Hunting is a structured, human-driven investigation process. A hunter starts with a hypothesis, such as "a credential-dumping tool ran on a domain controller last week," then queries logs, endpoint telemetry, and network data to confirm or disprove it. The process is iterative. Hunters use frameworks like MITRE ATT&CK to map adversary techniques and build queries around expected behaviors. Findings either surface a real intrusion or produce new detection rules that prevent the same gap in the future.

Why it matters

Automated tools catch known threats well. They struggle with novel techniques, slow-moving attackers, and living-off-the-land activity that blends into normal traffic. Threat hunting fills that gap. Studies consistently show that attackers dwell inside networks for weeks or months before detection. A regular hunting cadence shortens that window. It also surfaces blind spots in logging coverage and tuning gaps in existing detection tools like SIEM and XDR.

How tools address it

Tools in the Threat Hunting category accelerate the analyst's workflow rather than replace the analyst. Common capabilities include:

IOC sweeping: Matching known indicators across historical logs and endpoint data.
Infrastructure tracking: Mapping malicious IPs, domains, and command-and-control servers to find related activity.
Dark web indexing: Searching Tor and other darknets for leaked credentials or references to an organization.
MITRE ATT&CK integration: Surfacing relevant techniques and analytics, such as those in the MITRE Cyber Analytics Repository, to guide hypothesis formation.
Log investigation: Querying activity data without requiring a full SIEM deployment.

Detection Engineering is a close neighbor. Hunting often produces the raw material that detection engineers turn into permanent rules. Managed Detection and Response (MDR) services sometimes include hunting as part of their offering.

What is Threat Hunting?

What it is

Why it matters

How tools address it

Common confusions

Threat Hunting tools

Frequently asked questions