SOC / NOC · Specialist service
Advanced Threat Hunting — targeted searches for threats
Not every misuse scenario can be assessed from a current alert. A dedicated hunting campaign tests a specific hypothesis and identifies evidence that supports it or limits the assessment.
Service scope
Advanced Threat Hunting
We investigate specific questions, such as misuse of administrator accounts, persistent unauthorised access or unusual data transfers. We combine historical and current data with knowledge of the environment. Results include findings, their level of confirmation and the changes needed in telemetry, detection and security controls.
Investigation hypotheses
We select scenarios aligned with organisational risks and define the evidence needed to confirm them and the search scope.
Assessment of available data
We examine sources, the analysis period and record quality before determining whether reliable conclusions can be drawn.
Trace analysis
We investigate connections between accounts, devices, processes and communications within agreed permissions and available telemetry.
Improving protection
We translate findings into proposals for new detections, configuration changes and additional data needed for future analysis.
Project deliverables
What will your team receive?
- Campaign plan with hypotheses and data source scope.
- Report of findings, evidence and analysis limitations.
- Recommendations for detection and security control changes.
- Action list for SOC, S&VM or the client.
Delivery conditions
What do we agree before starting?
- Identification of the risks and systems the campaign will investigate.
- Access to agreed telemetry with appropriate retention.
- Contacts responsible for accounts, infrastructure and the applications under investigation.
How we work
From understanding the need to verifying the result.
Agree the investigation question
We define a hypothesis and check whether the available data can verify it reliably.
Conduct the campaign
Analysts examine traces, discuss anomalies with system owners and document findings as they emerge.
Review and act
We present conclusions, initiate handling of confirmed incidents and agree improvements to protection.
Clear responsibilities
What is already included, and what do we extend?
Searching for related traces during an incident is part of the core SOC service. Enterprise also includes an agreed core hunting cycle. Broader campaigns, additional hypotheses, new sources and deeper analysis beyond that scope are extensions.
Before making a decision
Questions about Advanced Threat Hunting
How does hunting differ from alert analysis?
A campaign starts with a hypothesis to investigate, rather than solely with a notification from a security tool. Analysis of related traces during an active incident remains part of the standard SOC service.
Does finding no traces mean there was no attack?
The conclusion applies to the investigated scenario, period and available data. We explicitly describe gaps that prevent particular actions from being confirmed or ruled out.
What happens when an active threat is detected?
The finding enters the appropriate incident handling process. SOC responds within agreed permissions, while the campaign provides additional context.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.