Articles about threat hunting from security operations practitioners.
I closed the ticket in about nine minutes. Weeks later an intel report made me reopen it as a by-hand hunt against old logs. The hunt found nothing, and that empty result was worth more than most of the true positives I have escalated.
The threat hunting program I inherited looked healthy on a slide: a hunt calendar, ATT&CK coverage in the high seventies, tidy quarterly reports. Not one hunt had changed a detection in eighteen months. This is how I separate a real hunt from a rebranded IOC sweep.
Our MDR renewal packet had a line item for proactive threat hunting, so I asked the account team to show me the hypothesis behind their last hunt. What came back was an indicator sweep with a hunting price tag. Paying hunting rates for work a script runs is a line item worth auditing before the next renewal.
Threat hunters spend Tuesday testing one written hypothesis against messy data, not browsing logs for fun. The real output is a shipped detection or a documented gap, even when the hunt finds nothing.
Practitioner takes on SOC modernization, detection engineering, threat hunting, and more. No fluff. No product pitches.