domains / families / security / hunting-advanced-persistent-threats

hunting-advanced-persistent-threats

separate

'Proactively hunts for Advanced Persistent Threat (APT) activity within

When to use

• Conducting proactive threat hunting sprints (typically 2–4 week cycles) based on newly published APT intelligence
• A UEBA alert or anomaly detection system flags behavioral deviations warranting deeper investigation
• A peer organization or ISAC sharing partner reports active APT compromise and you need to validate your own exposure

When not to use

• incident response when a confirmed breach is in progress

Skill page

Source