Threat hunting & intelligence
Looking for the attack your rules did not catch.
Our hunters start from a hypothesis, drawn from current threat intelligence and your own incident history, and search your data for proof. Every finding becomes a detection, so the next one is caught automatically.
Runs on your EDR and SIEM data. Available on its own or with MDR.
ops.example.com/hunts
Simulated environment, real workflow.
Operating model
Hypothesis in, detection out.
Hunting is scheduled work with a written outcome, not an analyst browsing logs when the queue is quiet.
Coverage
- Cadence
- Planned hunt cycles plus emergency hunts when a major threat breaks; cycle length set in your SOW
- Data
- Endpoint, identity, network, email and cloud telemetry already collected
- Method
- Hypotheses mapped to MITRE ATT&CK techniques, chosen for your industry and stack
- Intelligence
- Current campaigns, attacker tooling and indicators relevant to you
- Your contact
- Lead hunter who presents each cycle's results
Escalation flow
- 1
Day 1 · hypothesis set
Hypothesize
Pick the techniques most likely to be used against you right now, and say what evidence would prove them.
Start of each cycle
- 2
Day 3 · queries run
Hunt
Query across your telemetry, pivot on anything odd, and rule out normal behavior with your team.
Duration: fixed in the hunt plan
- 3
Day 4 · case opened
Escalate
A confirmed threat becomes a case right away, handled by MDR or your team.
Immediately on confirmation
- 4
Day 10 · detection shipped
Codify
Each finding and each blind spot becomes a new detection rule or a logging fix.
Before the cycle closes
Clock times show one illustrative case. Your SOW sets the target for each stage.
What we commit to in your contract
Each metric gets a target per severity in your statement of work (SOW), and every monthly review reports our times against it.
- Escalation
- Clock starts: Threat confirmed in a huntClock stops: case opened with MDR or your on-call
- Cycle report
- Clock starts: Cycle closesClock stops: written findings and new detections delivered
How each severity reaches you
- Critical
Escalate to you: On confirmation
Hand-off: MDR or your on-call
Written up: Same day
- High
Escalate to you: On confirmation
Hand-off: Case opened
Written up: In cycle report
- Medium
Escalate to you: Cycle report
Hand-off: Backlog item
Written up: In cycle report
- Low
Escalate to you: Cycle report
Hand-off: Recommendation
Written up: In cycle report
What a hunt leaves behind
Every hunt ends in a detection, a fix or a case.
A hunt follows one hypothesis hop by hop through your telemetry. Whatever it finds, or proves it cannot see, becomes something that runs every day after.
- Attack path
- Reachable, not exploited
| Step | Asset | What happened |
|---|---|---|
| 1 | Phishing email | Macro-enabled invoice opened |
| 2 | Workstation | Payload runs as the user |
| 3 | Cached admin creds | Admin token in browser storage |
| 4 | Domain controller | Token reused for directory admin |
| 5 | Customer DB | Target: 1.2M customer records |
Simulated environment, real workflow.
- New detections
- Logging fixes
- Escalated cases
| Group | New detections | Logging fixes | Escalated cases | Total |
|---|---|---|---|---|
| Q1 | 5 | 3 | 1 | 9 |
| Q2 | 7 | 2 | 0 | 9 |
| Q3 | 6 | 4 | 2 | 12 |
| Q4 | 9 | 2 | 1 | 12 |
Simulated environment, real workflow.
Hunt the path
Hunts start where an attacker would.
Hypotheses come from attack paths our testers and exposure data show are reachable in your estate, not from a generic list.
Each hunt follows one path hop by hop: exposed service, stolen credential, privilege, data.
Anything found is escalated to response the same day; anything missed becomes a new detection.
Hunts on AI systems look for prompt-injection attempts and unusual agent tool calls in your logs.
Every month
What lands on your desk.
Each hunt cycle closes with a written report and a walkthrough with your team.
Hunt report
Each hypothesis, the data searched, what we found and how confident we are.
New detections
Rules created from the hunt, ready to deploy in your SIEM or EDR.
Visibility gaps
Places we could not look because the logs were missing, and how to fix that.
Intelligence brief
Campaigns and techniques relevant to your sector this month.
ATT&CK coverage
Techniques hunted and covered, tracked over time.
Next cycle plan
The hypotheses we propose next, for you to adjust.
FAQ
Questions buyers ask us.
Anything else, ask an expert. You will talk to an analyst, not a script.
How is hunting different from monitoring?
Monitoring waits for a rule to fire. Hunting assumes something already got past the rules and goes looking for it.
Do we need MDR to buy threat hunting?
No. It runs on your EDR and SIEM data on its own. With MDR, confirmed findings go straight into response.
What if you find nothing?
That is still a result: you get evidence that a technique is not in use, plus the detections and logging fixes the hunt produced.
Can we suggest hypotheses?
Yes. Concerns from your team, recent incidents and audit findings all make good hunts.
How often do you hunt?
Cycle length and frequency are agreed per contract and written into your SOW.
Ask us what is hiding in your logs.
We propose three hunts for your environment and explain what each would look for.