Threat hunting
Threat hunting is a proactive search through security data for signs of malicious activity that existing alerts may not have identified.
Start with a question the data can answer
A hunt might ask whether an unusual account change was followed by access to a sensitive application. The analyst searches available records, investigates matches, and checks alternative explanations. Microsoft describes hunting as a way to investigate activity beyond existing detections, with findings feeding incident investigation or new detection rules.
Threat intelligence can suggest what to look for. It does not establish that the behavior occurred locally. The sector-reporting article explains how to check whether an external report fits your environment before adopting its assumptions.
A match needs interpretation
An uncommon process or unfamiliar sign-in is a lead, not a confirmed intrusion. Join it with the relevant identity, device, time window, and application evidence. Reading sign-in evidence walks through those distinctions.
The opposite result also needs care. No matches may mean the activity was absent, the query missed it, or the necessary records were unavailable. Record the data sources, retention window, and limits of the search alongside the conclusion.
A useful hunt can end without finding an attacker. Discovering missing telemetry or a repeatable detection opportunity gives the team concrete work to do. Turning a hunt into a scheduled alert then requires detection engineering, including checking how often legitimate activity matches.