After reading a report about a new adversary technique, analysts form a hypothesis and proactively search endpoint and network telemetry for signs that the technique was used in their environment, even though no alert has fired. Which activity is this?
Select an answer to reveal the explanation.
Short Explanation
Threat hunting is going looking for the burglar instead of waiting for the alarm. You start with a hunch about how attackers might be operating and dig through your own data to prove or disprove it. No alert fired - that's the clue.
Full Explanation
Threat hunting is the proactive, hypothesis-driven search for malicious activity that has evaded existing detections. Hunters typically start from threat intelligence, such as a newly reported adversary technique, form a hypothesis about how it would appear in their environment, and query endpoint, network, and log data for supporting evidence. Findings either confirm a compromise, which triggers incident response, or lead to new detection rules so the technique is caught automatically in the future. Alert tuning adjusts existing detection rules to reduce false positives or improve accuracy; it works on alerts that already exist rather than searching for undetected activity. Vulnerability scanning identifies weaknesses in systems, such as missing patches, and says nothing about whether an adversary has already used a technique. Penetration testing simulates an attack to test defenses; it generates attacker activity rather than looking for genuine adversaries in the telemetry. Exam caveat: threat hunting falls under identification because it detects incidents that would otherwise remain unknown, and its value depends on having sufficient telemetry retained to search. Operational check: record each hunt's hypothesis, data sources, queries, and result, and convert successful queries into scheduled detections.