Detection Engineering and Security Operations

Threat Hunting

We search your logs for attacker traces that did not trigger alerts, starting from a hypothesis. We turn findings into lasting detection rules.

Schedule a Meeting All services in this area

What it is

Threat hunting uses human analysis to find activity missed by automated detection. Each hunt begins with a hypothesis about a specific attacker behavior. For example, a hypothesis may focus on unusual use of legitimate remote administration tools. Even if no attacker is found, the hunt reveals visibility gaps and the need for new rules.

Scope

Hunt hypotheses derived from threat intelligence and MITRE ATT&CK
Searching EDR telemetry, authentication, DNS, proxy and cloud audit logs
Separating suspicious activity from legitimate business processes
Moving immediately to incident response when signs of an active attack are found
New detection rules and visibility gaps from each hunt

The need

When organizations need it

When an organization in your sector is breached and you want to know if the same group has left traces in your environment.
When you acquire a company and want to ensure the network you inherit is clean.
When there have been no critical alerts for a long time and someone questions whether that truly means no attack.

Method

How we work

Hypothesis

We build hunt hypotheses from the methods of groups targeting your sector and from your environment's structure.
Data check

We check that the logs needed to test the hypothesis exist and cover a sufficient time period.
Search and analysis

We search the logs for activity matching the hypothesis and separate legitimate work from attacker behavior.
Result

We report findings, new rules and visibility gaps. If we find signs of an active attack, we start incident response.

Outcome

What you have at the end

You receive an evidence-based answer on whether specific attacker behaviors are present in your environment. Every hunt leaves lasting detection rules and a list of visibility gaps to address.

Frequently asked questions

What happens if an active attacker is found during a hunt?

We inform you immediately through the agreed contact chain. We preserve evidence and move into incident response.

How is this different from a compromise assessment?

A compromise assessment looks across the entire environment at a single point in time for breach indicators. Threat hunting follows specific hypotheses, and each iteration improves your detection capability.

What data does hunting require?

EDR telemetry and authentication logs are used most. The retention period of your logs determines how far back the hunt can go.

Detection Engineering and Security Operations