Lesson 5 of 15 · 5 min read
Threat Hunting versus Detection Engineering
Threat hunting is a human-led search for adversary activity that existing detections have not caught. Hunts start from a narrow hypothesis about a behaviour, from a baseline of normal activity where rare values stand out, or from a model that ranks anomalies; the PEAK framework names these three types and wraps them in prepare, execute and act phases. Hunts should aim at behaviours high on the Pyramid of Pain rather than sweeping indicators. Every hunt, whether it finds something or not, should produce an output: an incident, a new automated detection, or a documented data gap.
free sign-in, no card required
Practise it as an interviewer asks it
Write a detection for a technique you care about. How do you choose data, write the logic, test it and keep false positives manageable?Design a detection-as-code programme: how are detections written, tested, reviewed, deployed and retired?How do you use MITRE ATT&CK to measure detection coverage, and how can a coverage heatmap mislead you?What would you log for a new service, and how do you write a detection with an acceptable false-positive rate?Your SOC is drowning in alerts. How do you reduce alert fatigue, and which metrics tell you it is working?What is threat hunting, how do you run a hunt, and how do you know it was worth the time?