Hunt Security Indicators
Overview
Turn validated evidence into bounded queries across known data sources, then validate matches in context. Absence of matches means only that the indicator was not observed in the recorded coverage.
Read references/hunt-record.md for query and coverage fields.
Workflow
- Define the hunt question and scope.
- Record incident/finding, assets, identities, environments, time window, data owners, privacy constraints, and expected decision.
- Normalize indicators and behaviors.
- Preserve type, value, source, confidence, first/last seen, expected context, variants, and expiration.
- Prefer behavior chains over one mutable hash/domain when telemetry supports them.
- Inventory data sources.
- Record endpoint/process/file, identity, DNS/network/proxy, application, cloud, email, vulnerability, and backup evidence plus retention, collection delay, and gaps.
- Write reproducible queries.
- Record platform/tool/version, exact query, normalization/timezone, filters, exclusions, and expected benign matches.
- Validate matches.
- Correlate asset/user/time/process/parent/path/signer/network or application context; preserve false-positive rationale.
- Expand deliberately.
- Pivot only from validated relations and update scope, indicators, and confidence.
- Report coverage.
- State searched/failed sources, earliest/latest available data, assets not covered, matches, negative results, and next response/detection action.
Output
Return hypothesis, indicators/behaviors, data coverage, queries, validated matches, false positives, gaps, pivots, and response recommendations.
1---2name: hunt-security-indicators3description: Hunt scoped systems and telemetry for supplied indicators or behaviors. Use for hashes, paths, domains, addresses, accounts, processes, persistence, ATT&CK behaviors, cloud events, or incident expansion with explicit scope and validation.4---56# Hunt Security Indicators78## Overview910Turn validated evidence into bounded queries across known data sources, then validate matches in context. Absence of matches means only that the indicator was not observed in the recorded coverage.1112Read [references/hunt-record.md](references/hunt-record.md) for query and coverage fields.1314## Workflow15161. Define the hunt question and scope.17 - Record incident/finding, assets, identities, environments, time window, data owners, privacy constraints, and expected decision.182. Normalize indicators and behaviors.19 - Preserve type, value, source, confidence, first/last seen, expected context, variants, and expiration.20 - Prefer behavior chains over one mutable hash/domain when telemetry supports them.213. Inventory data sources.22 - Record endpoint/process/file, identity, DNS/network/proxy, application, cloud, email, vulnerability, and backup evidence plus retention, collection delay, and gaps.234. Write reproducible queries.24 - Record platform/tool/version, exact query, normalization/timezone, filters, exclusions, and expected benign matches.255. Validate matches.26 - Correlate asset/user/time/process/parent/path/signer/network or application context; preserve false-positive rationale.276. Expand deliberately.28 - Pivot only from validated relations and update scope, indicators, and confidence.297. Report coverage.30 - State searched/failed sources, earliest/latest available data, assets not covered, matches, negative results, and next response/detection action.3132## Output3334Return hypothesis, indicators/behaviors, data coverage, queries, validated matches, false positives, gaps, pivots, and response recommendations.
gaelic-ghost