← Cyber Intelligence Foundations
Module 1: Start With the Decision
From Security Data to Intelligence Write an Intelligence Requirement
Module 2: Build an Evidence Base
Collect Evidence With a Plan Evaluate Sources and Claims
Module 3: Analyze, Report, and Improve
Describe Adversary Behavior Without Overclaiming Indicators of Compromise and Their Types Use Indicators With Context Write and Review a Decision-Ready Assessment
Module 4: Turn Intelligence Into Better Defense
Build a Bounded Defensive Hunt Keep Intelligence Useful Over Time
Module 5: Apply Intelligence to Common Security Problems
Build Vulnerability Intelligence That Prioritizes Action Analyze Identity and Social-Engineering Threats Analyze Malware and Ransomware Activity
Module 6: Operate Intelligence as a Capability
Work With Stakeholders and Decision-Makers Govern Intelligence and Handle Information Responsibly Share Structured Intelligence and Automate Safely
Module 4: Turn Intelligence Into Better Defense

Build a Bounded Defensive Hunt

Turn an intelligence judgment into a testable hunt hypothesis with known telemetry, limits, and an escalation path.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.

In this lesson, you will learn to:

  • Create a bounded hunt plan with a hypothesis, observable behaviors, telemetry sources, time window, expected results, and escalation criteria.

Build a Bounded Defensive Hunt

This lesson connects intelligence to defensive practice without pretending that a report is an investigation. You will define a hunt hypothesis, select the minimum useful telemetry, predict benign explanations, and decide how findings should be escalated.

Start With a Falsifiable Hypothesis

A hunt is not a request to “look for anything suspicious.” It is a structured attempt to test a proposition against available evidence. Start with a hypothesis that could be supported or weakened: “During the previous 30 days, an unauthorized actor may have used valid cloud credentials to create mailbox forwarding rules for finance users.” This statement names a behavior, a scope, and a time window.

Define what you expect to observe if the hypothesis is true: mailbox-rule creation, unusual sign-in locations, impossible travel, consent changes, or access from infrastructure associated with the campaign. Also define benign explanations: a migration, a help-desk action, a user traveling, or an approved automation. A hunt that cannot distinguish these possibilities will produce noise rather than learning.

Choose the smallest useful data set first. Identify the owner of each source, retention period, query language, and expected result. If the data is unavailable, record a collection gap instead of quietly changing the question. The point of a bounded hunt is to learn enough to make the next decision, not to search forever.

From intelligence judgment to hunt hypothesisA sequence adds behavior, scope, timeframe, expected evidence, and alternative explanations to an intelligence judgment. HUNT DESIGNMake the question testable BEHAVIORmailbox ruleSCOPEfinance usersTIMEprevious 30 daysEVIDENCEaudit eventsALTERNATIVEmigration?A HUNT SHOULD BE ABLE TO CHANGE YOUR MIND
From intelligence judgment to hunt hypothesis — A judgment becomes a falsifiable hunt hypothesis by adding behavior, scope, timeframe, expected evidence, and benign alternatives.

Define Results and Escalation Before Searching

Decide how you will interpret outcomes before you run the hunt. A positive result may be one confirmed event, a cluster requiring incident response, or a pattern that merits additional collection. A negative result should state the coverage and limitations: “No matching rules were found in the retained audit data for 82% of finance accounts; mailbox audit coverage for the remaining accounts is unknown.” That is more useful than “nothing found.”

Set escalation criteria in advance. Escalate when evidence shows unauthorized access, when multiple signals converge on the same account, or when the activity affects a critical business process. Route uncertain but potentially important findings to a named analyst for review. Do not automatically label every match an incident; preserve evidence and use the organization’s incident-response process when the threshold is met.

Close the loop by recording the result against the original requirement. Did the hunt answer the question, reduce uncertainty, reveal a telemetry gap, or generate a new requirement? The answer becomes part of the next intelligence cycle and prevents teams from repeating the same search without learning from it.

Hunt outcome and escalation pathsA hunt result routes to confirmed activity, an evidence-limited negative, or a new collection requirement. HUNT OUTCOMESInterpret the result before you act HUNT RESULTevidence + coverage + limitsCONFIRMED ACTIVITYpreserve + escalateNO MATCH IN COVERAGErecord limits, do not overclaimCOLLECTION GAPassign owner + next question
Hunt outcome and escalation paths — A hunt result branches into confirmed activity, an evidence-limited negative result, or a new collection requirement with explicit ownership.
← Previous: Write and Review a Decision-Ready Assessment Next: Keep Intelligence Useful Over Time →