Signaling threat hunting techniques

Hunting vs Triage

Threat hunting and alert triage are complementary SOC activities. Alert triage is reactive — alerts fire, analysts investigate. Threat hunting is proactive — analysts hypothesize about adversary behavior and search for evidence whether or not alerts have fired. Hunting matters because: not all adversary behavior triggers alerts (adversaries deliberately operate below detection thresholds); coverage gaps exist (no SOC has perfect detection); hunts can validate or invalidate threat-intel hypotheses; hunts that find activity become permanent detection rules, expanding automated coverage. For 5G,…