Hunts need stopping criteria
Decide in advance what would make you conclude the hypothesis is wrong, or the hunt does not end.
Without that, a hunt expands indefinitely as each absence of evidence prompts another place to look. Agreeing beforehand what data would settle it, and how long it gets, is what makes hunting a repeatable activity rather than an open-ended one that consumes whoever is best at it.
More on Threat hunting
- Hunting starts with a question, not a dashboardBring a question
- Absence of evidence depends on coverageOnly the lit part was searched
- Hunts can become future detectionsLeave a bell on the path
- Threat intelligence should change a question or actionDid it move the points? Intelligence is useful when it changes what you ask or what you do
- Entity context turns events into investigationsThread the beads
- Baseline means understanding normal variationNormal is a band, not a line