Threat hunting

The cyber threat hunting definition from Wikipedia, which comes from the whitepaper A Framework for Threat Hunting, from the company Sqrrl, bought by AWS, is as follows:

Cyber threat hunting is an active cyber defense activity. It is the process of proactively and iteratively searching through networks to detect and isolate advanced threats that evade existing security solutions.

Usually, the blue teams tend to automate as much as possible to free up time and ease the management of tools and detection rules. We don't want analysts to spend days watching dashboards or manually adding use cases all the time; automation and autogenerated alerts are preferred.

Still, for some situations, humans will always be needed to assess and analyze the situation and results provided by tools. That is exactly what threat hunting is about. It is typically adequate to perform a compromise assessment, that is to say, to verify and check, based on different hypotheses and...