Threat Hunting
What is Threat Hunting?
The proactive process of searching through networks and datasets to detect and isolate advanced threats that evade existing security solutions. Threat hunting combines human analyst expertise with automated detection tools.
Terms that appear alongside threat hunting
Each of these is named in at least one of the same controls as threat hunting. The number is how many controls name both.
- incident response 6 shared controls
- threat intelligence 6 shared controls
- mitre 5 shared controls
- risk assessment 4 shared controls
- governance 4 shared controls
- nist 4 shared controls
- audit 4 shared controls
- authentication 4 shared controls
Frameworks that govern threat hunting
What the standards actually require on threat hunting
Requirements naming threat hunting across 6 standards, quoted from the control text.
Conduct cyber threat hunting activities to search for indicators of compromise in organizational systems and detect, track, and disrupt threats that evade existing controls.
3.11.2e · Threat Hunting →The organisation establishes and maintains a cyber threat hunting capability to search for indicators of compromise and to detect, track and disrupt threats that evade existing controls, and uses it at a set frequency. No enhancements.
canada-itsp-10-033-security-and-privacy-controls-and-assurance-activities-catalogue::RA-10 · RA-10 Threat hunting →Hunts for adversary activity introduced through the supply chain rather than waiting for an alert.
161R1-RA-10 · Threat Hunting →a. Establish and maintain a cyber threat hunting capability to: 1. Search for indicators of compromise in organizational systems; and 2. Detect, track, and disrupt threats that evade existing controls; and b.
NIST800-RA-10 · RA-10 Threat Hunting →Proactive threat hunting finds adverse activity that evades automated detection (new in v4.0). Partially achieved: required resources identified and deployable occasionally (for example after a tip-off), hunts follow documented hypothesis, data or entity drive...
uk-ncsc-caf::C2.a · C2.a Threat hunting →Use skilled dedicated resources (in-house or outsourced) to analyse security activity and hunt threats; keep asset and monitoring systems current with normal behaviour baselines; tell monitoring teams about security-relevant changes;
uk-telecommunications-security-act-2021::M16 · M16.01 to M16.22, M20.01 Security monitoring and analysis: skilled analysts, threat hunting, 13-month logs, near real-time analysis within five minutes and anomaly models →Questions people ask about threat hunting
What is Threat Hunting?
Why is Threat Hunting important for compliance?
Which compliance frameworks address Threat Hunting?
Where can I learn more about Threat Hunting?
See how Threat Hunting applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.