Threat hunting: find whoever is already inside and made no noise
The most dangerous attacks are precisely the ones designed not to trip any alarm. Hunting well demands knowing what to look for and, above all, knowing your own ground.
Assume the breach instead of waiting for the alarm
Threat hunting is the proactive search for threats that have slipped past the automatic defences. It starts from an uncomfortable but realistic premise —«assume they are already in»— and, instead of waiting for an alert to fire, it forms hypotheses: if an attacker were here, what trace would they leave? Then it goes looking for that trace. It is the work that separates a reactive SOC from a mature one, because the most dangerous attacks are precisely the ones designed to trip no alarm.
Hunting well demands two things: knowing what to look for (knowledge of attacker tactics and techniques) and knowing where to look (knowing your own ground). Without a good map of your assets, hunting is groping in the dark.
Hunting over familiar ground
In Cloud Fortress, threat hunting rests on the live inventory and on all the context the platform already holds. The hunter does not start from zero: they start from a map of assets, owners, vulnerabilities and previous incidents. And what they find does not stay as a loose note — it stays attached to its asset and available to the rest of the team and to the next investigation.
Cross-references with
Frequently asked questions
How is it different from monitoring?
Monitoring reacts to what fires; hunting actively goes looking for what has not. They complement each other, and here they live in the same place.
Do I need an expert team to make use of it?
Judgement helps, but starting from an inventory and a context already assembled lowers the barrier considerably.
What happens to what I find?
It does not stay as a loose note. The finding attaches to its inventory asset and is available to the rest of the team and to the next investigation. If it warrants a response, it becomes an incident without leaving the platform.
What exactly do you hunt over?
Over your ground: the live inventory of endpoints, software, people and keys, plus vulnerabilities and previous incidents. Hunting well demands knowing what to look for and where; without a good asset map, the second half always fails.
How often does hunting make sense?
It is a campaign activity, not a continuous process: you form a hypothesis, look for its trace and close with a conclusion — even if that conclusion is «nothing here». What matters is that each campaign leaves a record, so the same search is not repeated six months later.
See it running with your data in front of you
30 minutes with a scenario close to yours. No canned deck, no strings attached.