A threat intelligence report names a suspicious process used in recent intrusions. No alert has fired in the organization, but threat hunters want to check whether that process has ever run on any endpoint. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
Hunting means you go looking before the alarm goes off. EDR keeps a searchable record of what ran everywhere, so you ask it one question across every endpoint. Waiting for an alert isn't hunting; it's hoping.
Full Explanation
Threat hunting starts from a hypothesis, often drawn from intelligence such as a process name, hash or command line, and searches existing telemetry for evidence rather than waiting for a detection to fire. EDR platforms store endpoint activity centrally and provide search and query tools across the whole fleet, so hunters can ask whether a given process or file has executed anywhere and on which hosts. In Cisco Secure Endpoint this includes searching events and trajectories and running live queries on connected endpoints. Waiting for an alert is reactive monitoring, and hunting queries are not limited to hosts that alerted; their purpose is to find activity that produced no alert. A full antivirus scan inspects files currently on disk against signatures; it does not report historical process executions, and a deleted or memory-resident tool would leave nothing to scan. Firewall logs record connections by address, port and, with application visibility, application, but they do not identify the endpoint process that generated the traffic. Exam caveat: a negative hunt result is bounded by telemetry retention and agent coverage, so unmanaged hosts remain a blind spot. Operational check: run the search across all groups, record matching hosts with first-seen times, and open device trajectory on any hit to scope activity.