Services · Defend
Threat hunting
Each hunt starts from a hypothesis about how an attacker could be operating in your environment, then tests it against your telemetry to find activity your detection rules have not caught.
What it covers
- Hypotheses drawn from threat reporting, MITRE ATT&CK techniques and your own environment
- Searches across endpoint, identity and cloud telemetry
- Investigation of anything suspicious, escalated as an incident if confirmed
- Logging gaps that limit what can be seen
- Candidate detection rules from what each hunt finds
How an engagement runs
Agree the focus
We agree with you which systems, data sources and threats matter most.
Form hypotheses
We write down what we are looking for and why, before running a single query.
Hunt
We search your telemetry, follow up anything unusual and rule out known-good activity.
Escalate what is real
Anything that looks like an active intrusion goes to your named contact straight away and is handled as an incident.
Report
We report what we looked for, what we found, and what should become a standing detection.
What you receive
- A written report for each hunt: hypotheses, data sources, queries and results
- The queries we ran, so your team can run them again
- Candidate detection rules for anything worth watching permanently
- A list of logging gaps that limited the hunt
Talk to us about threat hunting.
Tell us about your environment and what you need covered, and we will talk you through how it would work for you.