Can anyone please describe what is Threat Hunting and how it should be conducted/deploy/monitor? Is it similar to SIEM systems with more advanced and automated use cases?

I went through google search results and Wiki page of Threat hunting, and to me, it sounds similar to SIEM systems with some automation, ML, UEBA, and OSINT. I have worked on QRadar and I see a lot of new ML use-cases are getting released in regular updates in QRadar UBA (I guess the same thing is happening for other SIEM products). This increase my confusion regarding Threat Hunting.


Threat hunting is the human-driven, proactive and iterative search through networks, endpoints, or datasets to detect malicious, suspicious, or risky activities that have evaded detection by existing automated tools.

You can use a variety of tools and techniques to look for that !it's not related to a certain tool/technology! you just conduct investigations missions on your systems to find hidden threats/on going attacks ! you can check the Sqrrl for a first understanding :) https://sqrrl.com/media/Your-Practical-Guide-to-Threat-Hunting.pdf

i'm working on that currently and trust me it's another world ;)

  • thanks for sharing this guide. This is really very comprehensive and practical. – 0xSecNerd Apr 11 at 4:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.