Source: Black Hills Information Security
Author: Faan Rossouw
URL: https://www.blackhillsinfosec.com/threat-hunting-fly-wheel/
ONE SENTENCE SUMMARY:
Threat hunting’s goal is continuous security improvement by iteratively focusing, investigating, learning, and refining defenses to reduce future risk.
MAIN POINTS:
- Ultimate objective shifts from incident discovery to lowering future compromise probability.
- Debugging analogy shows hunts teach system lessons and improve security “testing.”
- Viewing hunting as a cycle reinforces iterative learning and compounding program maturity.
- Choosing a focus solves the “where do we start?” problem in large log environments.
- Hypothesis-driven hunts leverage threat intelligence to target likely adversary behaviors.
- Baselining defines normal operations, making deviations easier to spot and assess.
- Statistical tools like RITA prioritize anomalous connections and behaviors for review.
- Machine learning flags deviations with confidence scoring to guide investigation starts.
- Investigations narrow iteratively, separating known-good context from suspicious threads.
- Refinement turns findings into detections, documentation, hypothesis generation, and gap closure.
TAKEAWAYS:
- Treat “no findings” as valuable validation and detection-quality assessment.
- Blend multiple hunting approaches over time for a more mature program.
- Convert recurring hunt patterns into automated detection rules to scale effort.
- Document environmental baselines and share learnings to multiply team effectiveness.
- Expect compounding benefits, often accelerating after 12–18 months of sustained hunting.