D3 Smart SOAR is a Security Orchestration, Automation and Response platform that focuses on threat hunting and investigation capabilities. The platform uses signature and behavior-based methods to locate threats within an environment through automated playbooks. The system extracts indicators of compromise (IOCs) from incoming incidents and automatically searches for them across events, logs, and endpoints. It can place IOCs and TTPs under surveillance with playbooks that track them continuously and alert when they appear in incidents. The platform includes a MITRE ATT&CK Monitor dashboard that tracks and visualizes the occurrence of each ATT&CK technique in the environment. Threat hunting workflows are orchestrated through Tier 3 playbooks that contextualize security events using integrations with email, identity, endpoint, and network tools. The platform offers investigation management features that enable scheduling of automated threat hunts and review of results. It automatically parses reports from integrated threat intelligence sources and searches for their IOCs. The system can identify connections between events, uncover user accounts responsible for malicious processes, and expand searches to find related IOCs across an organization.