domains / families / security / threat-hunting

threat-hunting

authentic

Blue-team threat hunting: detection engineering with Sigma/YARA, SIEM query design, and validation of incident detections against known technique patterns.

When to use

• Proactively hunting for adversary activity in telemetry.
• Writing or validating detection rules mapped to ATT&CK techniques.

When not to use

• Hypothesis quality bounds results; weak telemetry yields weak hunts.
• Rule tuning is continuous; expect false positives initially.

Skill page

Source