Threat Hunting or Alert-Driven?

About this interactive

Even a robust monitoring system misses things. An attacker can get around the logging, or attack the logging server and remove logs, so an automated system will not catch everything. Threat hunting is a person looking: going through the equipment, the logs and the network links for indicators of compromise. The lesson compares it with penetration testing, where a person does what a vulnerability scanner does automatically. A SIEM aggregates the logs, looks for known patterns and alerts; where the automation fails, the hunter picks up. The word the lesson stops on is proactive. Hunting does not wait for an alert: it starts before any monitoring system has said there is a problem. So an analyst working through an alert the SIEM raised is responding to monitoring, while the same analyst searching last month's logs on a hunch, with no alert, is hunting.

What you'll learn

Tell threat hunting, where a person goes looking for signs of compromise before any alert, from monitoring that runs on alerts, where automated systems such as a SIEM flag activity and people respond
Explain why hunting is needed even with good monitoring: attackers can get around logging or remove logs, and automation does not catch everything

Aligned to

CompTIA Security+

4.4 Explain security alerting and monitoring concepts and tools.

4.8 Explain appropriate incident response activities.

CompTIA CySA+

1.4 Compare and contrast threat-intelligence and threat-hunting concepts.

NIST 800-53

RA-10 Threat Hunting

NIST CSF

DE.AE-07 Cyber threat intelligence and other contextual information are integrated into the analysis.

Key terms

Threat Hunting: Threat hunting is a proactive security practice in which analysts actively search for signs of adversary activity that has evaded automated detection, using hypotheses driven by threat intelligence and behavioral anomalies.
Security Information and Event Management: A system that aggregates and analyzes security event data from across an organization to detect and respond to threats.
Indicators of Compromise: Indicators of Compromise are forensic artifacts such as file hashes, IP addresses, domain names, and registry keys that provide evidence a system may have been compromised, enabling threat detection and intelligence sharing.
Threat Intelligence: Information about existing or emerging threats that helps organizations make informed security decisions.

Topics

Threat Hunting Siem Monitoring Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →