Threat Hunting

SANS describes threat hunting as an active practice for finding an adversary already inside the environment. Splunk’s PEAK framework defines it as any manual or machine-assisted search for what automated detection missed, and names three kinds of hunt. Each asks something different of the data.

A hypothesis is only as useful as the question the tool can express. Failed VPN logins by user, PowerShell abuse in Sysmon or traffic to a blacklisted destination each have to survive translation into a query.

ARRTECH SIEM answers in a two-layer search language: a base search that selects sources, filters, groups and orders, then a pipeline of functions for statistics, lookups, geolocation and event combination. Classification turns vendor codes into plain categories, so one query for a successful login covers every vendor.

It searches raw logs in per-source indexes with retention you set, compressed at least 20:1, and an Archive Search page runs the same queries over archived logs. A hunt for the first sign of a compromise reads the logs written that day, signed and unchanged.

Lateral movement is the hunt every method names first, and it does not sit in one log. The sign-in, the new session and the new process are each ordinary in their own source. The hunter needs the path, not the hops.

ARRTECH SIEM keeps a graph database of the threat neighborhood around each user and entity, and a graph query language walks it. Its forensic module reconstructs the sequence of events across network, system and application logs and maps allowed and blocked connections.

Cyberdroid AI Detection, part of the Cyberdroid SOC Platform, the AI layer of the ARRTECH Security Suite, maps relationships across identity, network, DNS, process and firewall telemetry, read from the SIEM export. A lateral-movement hunt follows the path instead of matching each hop.

The SANS 2025 survey found living-off-the-land techniques in 76% of nation-state attacks. The tools are the administrator’s own, so there is no signature to match. The only signal is a user or host departing from its own history.

Cyberdroid AI Detection baselines every user, host and application against its own history and its peers. Every finding shows the observed value, the baseline, the score and the threshold, with an ordered evidence timeline.

Each of its 21 detectors runs in shadow until replay on your own telemetry proves it, and shadow findings arrive in a separate channel. To a hunter, that channel is the model-assisted hunt: a finding is a hypothesis with evidence attached.

A hunt that ends in a document is run again next quarter by hand. The SANS 2025 survey found that only 51% of organizations formally measure hunting. The output has to become a detection, and what the detection finds has to reach a person who can act.

A query worth repeating is saved in ARRTECH SIEM as an alert or a correlation rule, so the next occurrence raises itself. A hunt that is not yet an incident opens a pre-incident case with its MITRE tactic and owner. The MITRE ATT&CK page shows which techniques your detections cover.

Isolating a host or disabling an account is a decision, and it belongs to people. Neither ARRTECH SIEM nor Cyberdroid AI Detection acts on the estate. A person approves, and ARRTECH SOAR runs the playbook from the alert action, with every decision recorded.

What the products do not do for a hunt.