Hunt scope should be explicit
Saying which systems, which period and which data you looked at is what makes the result mean anything.
"We hunted for this and found nothing" is not a finding unless it comes with boundaries. Otherwise nobody can tell whether the absence covers the whole estate or three servers somebody had access to. The scope is also what lets somebody else extend the work later rather than repeat it.
More on Threat hunting
- Hunting starts with a question, not a dashboardBring a question
- Absence of evidence depends on coverageOnly the lit part was searched
- Hunts can become future detectionsLeave a bell on the path
- Threat intelligence should change a question or actionDid it move the points? Intelligence is useful when it changes what you ask or what you do
- Entity context turns events into investigationsThread the beads
- Baseline means understanding normal variationNormal is a band, not a line