Knowledge Base

Threat Hunting Workflow and Hypothesis Management

Frame hunts around evidence questions, known gaps, and repeatable handoffs.

Hunt plan

State the objective, hypothesis, scope, time range, data sources, assumptions, known gaps, query plan, pivots, evidence, confidence, and closure criteria. Hunts may be triggered by a signal or proactive. They should focus on defensive behavior and evidence, not stealth or evasion techniques.

Workflow

  1. Define a testable hypothesis and approved data boundaries.
  2. Record pivots, findings, unknowns, and negative results with source and time context.
  3. Hand supported findings to incident response and detection opportunities to engineering.

Fictional example

An impossible-travel hypothesis compares identity events and approved travel context. The team finds a clock-quality gap in one source, records it, and requests more evidence instead of calling the account compromised.

Related: Alert Intake, Incident Timeline, Hunt Tool.