Absence of evidence depends on coverage
"We found nothing" means very different things depending on where you were able to look.
Nothing found across complete telemetry for the whole period is meaningful. Nothing found on the forty per cent of machines reporting, for the thirty days retained, is barely a statement at all. Reporting the conclusion without the coverage turns a limitation into a false reassurance, and it is one of the easiest mistakes to make in good faith.
More on Threat hunting
- Hunting starts with a question, not a dashboardBring a question
- Hunts can become future detectionsLeave a bell on the path
- Threat intelligence should change a question or actionDid it move the points? Intelligence is useful when it changes what you ask or what you do
- Entity context turns events into investigationsThread the beads
- Baseline means understanding normal variationNormal is a band, not a line
- Hunt scope should be explicitPeg out the ground first