Understanding the hunt results

All the exercises done so far have had an inherent unfairness to their nature: they were all made in a lab environment. The differences between hunting in a lab environment versus hunting in production are notable. Probably, the number of devices in our lab is going to be much smaller than the number of devices available in production. The same will happen with the number of users and the "noise" they generate by user interaction with the system.

This means that when testing our detections over production, we will most likely have to refine our detection queries to reduce the number of hits we get as a result. Threat hunting is not about verifying false positive results (although you will encounter those too), but about finding the false negatives. In other words, we are not trying to verify that the detected events are not malicious but rather to build detections for malicious behaviors that have surpassed our organization's detection...