Hunt plan
State the objective, hypothesis, scope, time range, data sources, assumptions, known gaps, query plan, pivots, evidence, confidence, and closure criteria. Hunts may be triggered by a signal or proactive. They should focus on defensive behavior and evidence, not stealth or evasion techniques.
Workflow
- Define a testable hypothesis and approved data boundaries.
- Record pivots, findings, unknowns, and negative results with source and time context.
- Hand supported findings to incident response and detection opportunities to engineering.
Fictional example
An impossible-travel hypothesis compares identity events and approved travel context. The team finds a clock-quality gap in one source, records it, and requests more evidence instead of calling the account compromised.
Related: Alert Intake, Incident Timeline, Hunt Tool.