Okuzeka
Cybersecurity vocabulary · Security Operations and Monitoring

Threat hunting

Meaning in cybersecurity, with examples

nounAdvanced term

In cybersecurity, threat hunting means: Actively searching through systems and logs for signs of attackers who have not yet been detected by automated alerts, often starting from a hypothesis.

In Turkish: tehdit avcılığı

How it is used

Done by experienced analysts, often at Tier 3. A hunt starts from a hypothesis ('an attacker may be using remote management tools'), uses SIEM and EDR data and ideally ends with new detection rules. People say they 'run a hunt'.

Example sentences

  1. Our weekly threat hunting session found an old admin tool running on a file server.

  2. After the advisory, we started threat hunting for the new IOCs across all endpoints.

Common collocations

  • threat hunting team
  • run a hunt
  • hypothesis-driven hunting
  • hunting query
  • SOCSecurity operations centre: the team, and often the room, that monitors an organisation's systems around the clock and responds to security alerts.
  • SIEMSecurity information and event management: a platform that collects logs from many systems, correlates them and raises alerts about possible attacks.
  • EDREndpoint detection and response: security software on laptops and servers that records activity, detects suspicious behaviour and lets analysts investigate and respond remotely.
  • threat intelligenceCollected and analysed information about attackers, their methods and their tools that helps an organisation prepare for and detect attacks.
  • indicator of compromiseA piece of technical evidence that suggests a system may have been attacked, such as a malicious IP address, file hash or domain name.

This word in other fields

The same English word can have a different meaning in another field:

More terms: Security Operations and Monitoring

Practise with graded reading

Reading at the right level is the fastest way to make new words stick. Pick free English books by level: