What it means
Intelligence-led threat hunting converts validated adversary knowledge into hypotheses, data requirements, analytic methods, and searches for activity that existing detections may miss.
Why it matters
It focuses limited hunting time on plausible threats while producing lessons that can improve telemetry and durable detections.
Practical focus
- Start with a testable behavior-based hypothesis
- Confirm required telemetry is available
- Record findings and negative results
- Convert repeatable findings into detections or controls
Common mistakes
- Hunting only for static indicators
- Beginning without a defined question
- Treating no findings as proof of absence
- Failing to operationalize successful hunts
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: