Threat hunting
Also called threat hunt, cyber threat hunting
Searching your own systems for an attacker that no alert has reported, starting from a hunch about how they'd behave.
Threat hunting is going to look for an attacker instead of waiting to be told about one. A hunter starts from an idea, such as "if someone had stolen a service account, it would sign in the way a person does", and searches systems and logs for signs of it. The aim is to find threats that got past the existing controls, as early in the attack as possible.
It differs from alert work in where it starts. An alert begins with a rule that fired. A hunt begins with a question, and the work is turning that question into searches.
That is the step AI has sped up, and it brings one risk with it: a search that is wrong in meaning returns nothing, and a hunt that returns nothing gets closed.
For example
No alert has fired, but an analyst suspects service accounts are being misused and searches a week of sign-ins for any that a person made.
Put it to use
Where you'll meet threat hunting in ChatGPT, Gemini and Claude, how to use it there, and the mix-up most people make.
Daily Bytes Plus is in the Android app.