Case 910914 · Blue team / DFIR · L4 Advanced
Running a Threat Hunting Program
Interview questionYou are asked to start a threat hunting program. How do you run it and show it is worth the time?
- 01 What is it?
- 02 How is it abused?
- 03 How do you stop it?
What a strong answer covers
Try it out loud first. Then check yourself:
- Use a repeatable method such as PEAK: prepare a hypothesis and data, execute, then act on what you learned.
- Mix hunt types: hypothesis-driven from intel or ATT&CK, baseline hunts to learn normal, and model-assisted hunts.
- Maturity grows from ad-hoc searches to hunts that routinely become automated detections (the Hunting Maturity Model, HM0 to HM4).
- Measure outputs, not hours: detections created, visibility gaps logged and fixed, incidents found, and techniques now covered.
If the interviewer pushes back
- Six months in, the hunts have found nothing malicious. How do you show leadership the program still has value?