At a hotel, one team reads an external report about a campaign while another team searches hotel logs for the behavior described in that report. Which team is threat hunting?
Select an answer to reveal the explanation.
Short Explanation
Reading a weather bulletin is not the same as walking your grounds to see whether the storm is already in the trees. You call hunting the search of the hotel's own logs for the reported behavior. The trap is filing the report, patching devices, or rewriting a privacy policy.
Full Explanation
Threat hunting is a search of your own environment for activity you have reason to look for. Using an external report as the hypothesis is still hunting when the work is queries against hotel telemetry. Reading, patching, and policy editing can follow the same report and are different jobs. "The team searching the hotel's own telemetry for the behavior described in the external report". That team is searching the hotel's own logs for the behavior, which is the hunt. "The team that only reads the external campaign report and files it for later staff awareness". Reading and filing an external report is intelligence consumption. No search of hotel telemetry has happened in that description. "The team that patches guest-network devices after the report names a vulnerable software build". Patching a named build is vulnerability handling. It changes software, and it is not a search of logs for the campaign behavior. "The team rewriting the guest privacy policy so the wording tracks the new campaign notice". Rewriting a privacy notice changes guest-facing policy text. It does not look through hotel telemetry for the activity in the report. Exam caveat: a hunt may start from a report, and the report alone is not the hunt. The exam separates threat hunting from simply consuming threat intelligence. Operational check: the hunt record should show queries against hotel logs for the reported behavior, not only a stored copy of the external report.