Threat Intelligence and Proactive Hunting
This domain tests operationalizing threat intelligence and running hypothesis-driven hunts. You need to know how indicators age, how confidence affects use, and how a hunt becomes a durable detection.
Core intelligence and hunting rules
- Threat intelligence management ingests feeds, normalizes indicator types, and applies confidence, TTL, and scoring.
- Not all intelligence is equal: a low-confidence indicator from an open feed should not automatically block or close an incident.
- Indicators expire. Respect TTL and avoid using stale indicators as definitive evidence.
- Map detections and hunts to MITRE ATT&CK to find coverage gaps.
- Hunting starts with a hypothesis, not a random query. Query XQL across relevant datasets, baseline normal behavior, isolate outliers, and validate on the endpoint.
- Feed hunt results back into detection content so the same pattern is caught automatically.
Worked example
Hypothesis: a rare parent-child process pair indicates malicious macro execution. Run an XQL aggregation over 30 days counting process pairs and parent processes. Compare against a baseline and filter to pairs seen on only one or two hosts. Investigate the outliers: if winword.exe spawns an unsigned PowerShell child that contacts a new domain, validate on the endpoint and scope other hosts. If confirmed, create a BIOC and document the hunt. The reasoning is that rarity is a lead, not proof; endpoint validation supplies the evidence.
Traps that cost marks
- Treating every feed indicator as ground truth.
- Ignoring TTL, confidence, and indicator type.
- Hunting without a written hypothesis or defined data sources.
- Overfitting a baseline and missing low-volume malicious activity.
- Failing to convert validated hunt findings into detection content.