In short
Threat hunting is the proactive search for attackers who are already inside your network but have not triggered an alert. Hunters form a hypothesis, often based on MITRE ATT&CK techniques, search EDR telemetry for evidence, and turn findings into response actions and new detections. You can hunt with your EDR console's tools or use a vendor's managed hunting service.
Get a quote for threat hunting
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What is threat hunting?
Detection products work by recognising patterns. Skilled attackers try hard not to match them: they sign in with valid credentials, use the remote access and admin tools your IT team uses, and spread their activity over days. Each step on its own can look normal.
Cyber threat hunting assumes that something may have got through and goes looking for it. A hunter starts with an idea of what an attacker might be doing, searches the recorded activity from your devices for evidence, and either rules it out or finds something to investigate. Good hunts also leave something behind: a new detection rule, a hardening change or a gap closed, so the same technique is caught automatically next time.
Hunting depends on data. Without the device telemetry that endpoint detection and response records, there is very little to hunt through, which is why it is usually discussed alongside EDR and extended detection and response.
How hypothesis-led hunting works
- Form a hypothesis. For example: "an attacker may be using a remote admin tool we do not use to keep access", or "someone may be dumping credentials from memory on our servers". Hypotheses come from threat reports, recent incidents in your sector, or techniques in the MITRE ATT&CK knowledge base.
- Decide what evidence would look like. Which processes, command lines, network connections or logons would you expect to see if the hypothesis were true?
- Search the telemetry. Use the EDR console's search across every device and the history it keeps. Narrow down from many results to the few that are unusual for your organisation.
- Investigate what you find. Follow process trees and timelines, check the user and device involved, and decide whether it is legitimate.
- Respond. If it is malicious, contain it: isolate devices, disable accounts, remove persistence. This is where hunting hands over to incident response.
- Improve. Turn what you learned into a detection rule, a policy change or a hardening step, and record the hunt so it can be repeated.
Using MITRE ATT&CK to plan hunts
MITRE ATT&CK is a public catalogue of the tactics and techniques attackers use, from initial access through persistence, credential access and lateral movement to impact. It is useful for hunting in two ways. First, it gives you a structured list of things to look for. Second, most EDR platforms label their detections with ATT&CK techniques, so you can see which techniques your tools already detect well and focus hunts on the ones they do not.
A simple approach for a small team is to pick a handful of techniques relevant to how attackers usually get into organisations like yours, such as abuse of valid accounts, remote services and scheduled tasks, and hunt for each on a regular cycle.
Threat hunting tools in EDR consoles
You do not need a separate product to start hunting. The EDR platforms we supply include search and live investigation tools:
| Platform | Hunting and investigation tools |
|---|---|
| CrowdStrike Falcon | MITRE ATT&CK-mapped detections, Real Time Response for direct access to a device, Charlotte AI-assisted investigation; Falcon Data Replicator can stream raw events to your own storage |
| SentinelOne Singularity Complete | Deep Visibility search across EDR telemetry, Storylines that link related activity, Purple AI natural-language queries, 14 days of searchable history as standard |
| Bitdefender GravityZone EDR | Historical and Live Search for indicators of compromise and endpoint configuration, attack-chain visualisation |
| WatchGuard Endpoint Security Elite | Correlated attack timelines and process trees, natural-language searching of telemetry, remote access to affected endpoints |
| Sophos EDR | AI search in plain English, AI command analysis, Live Response shell access |
| Check Point Harmony Endpoint | Automated forensics reports mapped to MITRE ATT&CK and threat hunting in the console |
| TrendAI Vision One | Search and investigation across endpoint and other sensor data, with a forensics option |
Natural-language search features make hunting much more approachable for generalist IT teams, because you can ask a question rather than write a query. Retention matters too: you can only hunt as far back as the platform keeps searchable data.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Managed threat hunting from vendors
Hunting takes time and specialist skill, so several vendors we supply offer it as a service run by their own hunters. Licensing for each is set out on Software Licensing UK.
| Service | What the vendor provides | How it is packaged | Licensing |
|---|---|---|---|
| CrowdStrike Adversary OverWatch | CrowdStrike's hunters look around the clock for hands-on-keyboard intrusions and attacker tradecraft, and alert you when they find something | Included in the Falcon Advanced Defend and Falcon Complete Defend bundles | Falcon Defend |
| SentinelOne Wayfinder Threat Hunting | Continuous hunts based on indicators of compromise and behaviour, validated findings in your Singularity console and Flash Reports on emerging threats; previously known as WatchTower | Add-on to Singularity Complete; packaging confirmed at quote | Wayfinder Threat Hunting |
| ThreatDown Managed Threat Hunting | Proactive hunting for indicators of compromise, prioritised alerts for critical threats and step-by-step remediation guidance; you or your IT provider carry out the fix | Runs on the ThreatDown agent alongside ThreatDown EDR | ThreatDown MDR |
| Bitdefender MDR | Threat hunting as part of Bitdefender's managed detection and response service, which Bitdefender describes as 24/7 monitoring, investigation and response by its security operations team | Built on GravityZone EDR | GravityZone EDR |
Managed hunting finds and reports threats. It does not usually include the hands-on response that a managed detection and response service provides, so decide who will act on findings. If the answer is nobody out of hours, look at the vendor's MDR service instead, such as Bitdefender MDR or SentinelOne Wayfinder MDR.
Threat hunting vs incident response vs MDR
| Threat hunting | Incident response | Managed detection and response | |
|---|---|---|---|
| Starts with | A hypothesis, before any alert | A confirmed or suspected incident | Alerts from your security tools |
| Goal | Find hidden attackers and gaps in detection | Contain, eradicate and recover from an incident | Monitor, triage and respond on your behalf |
| When | Regularly, on a schedule or after new threat reports | When something has happened | Continuously, within an agreed policy |
| Output | Findings, new detections, hardening changes | A contained incident and lessons learned | Handled incidents and reports |
| Who does it | Your team or a vendor's hunters | Your team, your IT provider or a specialist | The vendor's analysts |
The three work together: hunting finds what alerts missed and hands it to incident response, and an MDR service usually includes some hunting alongside its monitoring. Our Cloud Security site explains managed detection and response in more depth.
Is threat hunting the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How we help
We can help you decide whether hunting in-house, a vendor's managed hunting service or a full MDR service fits best, check that your EDR keeps enough history for hunters to look back, and agree who receives findings and how quickly they are acted on. Pricing is confirmed at quote.
Contact us to talk about threat hunting for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos and Check Point Harmony
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
What is threat hunting in cyber security?
Threat hunting is the proactive search for attackers who are inside your environment but have not triggered an alert. Hunters start from a hypothesis, search device and other telemetry for evidence, investigate anything unusual and turn findings into response actions and better detections.
What tools are used for threat hunting?
Mostly the search and investigation tools in EDR and XDR consoles: telemetry search, process trees, timelines and live response, often with natural-language search. Frameworks such as MITRE ATT&CK help plan hunts. Some organisations also use a SIEM for wider log data.
What is the difference between threat hunting and incident response?
Threat hunting is proactive and starts before any alert, looking for hidden attackers. Incident response is reactive and starts once an incident is suspected or confirmed, with the aim of containing it and recovering. Hunting findings are handed to incident response.
Do small businesses need threat hunting?
Most small businesses get more value from a vendor-run managed detection and response service, which usually includes some hunting alongside monitoring and response. Dedicated managed hunting suits organisations with an in-house team that can act on findings.
Which vendors offer managed threat hunting?
Among the vendors we supply: CrowdStrike Adversary OverWatch, SentinelOne Wayfinder Threat Hunting, ThreatDown Managed Threat Hunting, and threat hunting within Bitdefender MDR.
Still have a question about threat hunting?
Ask us and a member of our team will reply by email.