At a bank, no alert has fired, yet an analyst searches authentication logs for a rare remote tool that recently compromised a peer institution. Which term names that search?
Select an answer to reveal the explanation.
Short Explanation
You are walking the fence line with a flashlight before any alarm rings. Searching the bank logs for a rare tool a peer already suffered is threat hunting. Reading an outside feed, declaring an incident you have not found, and patching systems are different work.
Full Explanation
Threat hunting is a proactive search of the bank's own data when no alert has fired, driven here by a technique a peer already saw. Threat hunting: a proactive search of authentication logs for a rare tool a peer already saw, names that work. Threat intelligence: reading an external indicator feed rather than searching the bank's own logs, is consumption of an outside feed, and this analyst is querying the bank's authentication logs. Incident declaration: fitting only after evidence already shows an attack is underway at the bank, would require a finding the search has not produced. Patch management: applying updates to close known flaws instead of searching for that tool, changes systems and does not search logs for the rare tool. The peer incident supplies the hypothesis, and the bank's own authentication logs are where that hypothesis is tested. Exam caveat: if the search finds the tool in use, the work can move into incident handling; until that finding, it remains a hunt. Operational check: write the hypothesis and the authentication-log query in the hunt notes before anyone calls the result an incident.