All playbooks
Threat hunting · Threat hunters, detection engineers and SOC leads
Promote a hunt into a detection
Move from an exploratory query to a testable rule and analyst response.
A hunt query becomes operational only after its evidence, benign boundary and response are reviewed.
What this does not establish
- One interesting hunt result does not predict recurring alert volume.
- A converted Sigma rule does not establish native target behavior.
- A technique mapping does not demonstrate production sensor coverage.
0 of 8 ticked
Selected step
FrameStep 1 of 8
Keep the hunt hypothesis with the candidate rule.
Record the behavior and original finding
- Separate the observed event from the broader behavior you want to catch.
- Name which variants are deliberately outside scope.