domains / families / security / performing-threat-hunting-with-elastic-siem

performing-threat-hunting-with-elastic-siem

separate

'Performs proactive threat hunting in Elastic Security SIEM using KQL/EQL

When to use

• SOC teams need to proactively search for threats not caught by existing detection rules
• Threat intelligence reports describe new TTPs requiring validation against historical data
• Red team exercises reveal detection gaps that need hunting query development
• Periodic hunting cadence requires structured hypothesis-driven investigations

When not to use

• real-time alert triage

Skill page

Source