Hunts can become future detections
Anything you found by hunting that would be worth catching automatically should become a rule.
Otherwise the same hunt gets repeated by a different person next year. The pipeline from hunt to detection is what makes the effort compound rather than being a series of one-off investigations, and it is the main reason hunting is worth the time of people who could be doing other things.
More on Threat hunting
- Hunting starts with a question, not a dashboardBring a question
- Absence of evidence depends on coverageOnly the lit part was searched
- Threat intelligence should change a question or actionDid it move the points? Intelligence is useful when it changes what you ask or what you do
- Entity context turns events into investigationsThread the beads
- Baseline means understanding normal variationNormal is a band, not a line
- Hunt scope should be explicitPeg out the ground first