Explain like I'm five · Security

What is Threat Hunting?

Threat hunting, told as a story about the guard who goes looking with a lantern before the bell ever rings.

guard roomall quiettwo eyes inside the closetthe bell can be silent while a thief is already inside

The bell is silent. But someone is in the closet.Quiet doesn't mean empty. A thief can hide for months.

WANTEDrings for known facesa thief no one has seen…new thieves and quiet thieves never ring the bell

The bell only rings for thieves it knows.A new thief who isn't on the wanted poster, or one who walks without a sound, never rings the bell.

if I were a thief, where would I hide?found oneeven with no bell, walk every corner with a lantern

Threat hunting is going to look instead of waiting for the bell.Assume a thief is already inside, think about where one would hide, and shine the lantern into every corner.

Assume they're inquiet isn't proof
One questionwhere would a thief hide?
Dig the diaryfind the odd line
Hang a new bellso it rings next time
a thief would open the storeroom at night, right?DIARY2 pm · storeroom opened · cook5 pm · storeroom opened · cook3 am · storeroom opened · cook?3 am · storeroom opened · cook?9 am · storeroom opened · cookbut the cook is asleep at 3 amfind the one odd line among thousands

Take one question and dig through the diary.Among thousands of diary lines, find the odd one. "The cook opened the storeroom at 3 am?" — the cook was asleep.

DIARY3 am · storeroom opened · cook?NEW BELL RULEstoreroom opens at night→ ring the bellnext time it ringsthe guard room takes it from herethe hunter moves on to the next question

What you find becomes a new bell.A thief's habit found by hand becomes a rule on the guard room screen. Next time the bell rings on its own.

In one breath

Threat hunting = even with no bell, assume they're in, take one question, dig the diary for the hidden thief, and hang a new bell.

Instead of waiting for alerts, hunters form a hypothesis and search logs for intrusions nothing detected. What they find becomes a detection rule.

When grown-ups say it

Assume breach
Assume they're already in. Quiet is not proof. Where every hunt starts.
Hypothesis
One question. "A thief would open the storeroom at night, right?" → a thief's habits
Alert
The bell. Rings only for known thieves. → the guard with the wanted poster
Logs
The diary. Where the hunter digs. → the one-line diary
Dwell time
Days spent hiding. How long a thief was inside with no bell. Hunting shortens it.
Detection rule
A new bell. A found habit, hung on the guard room screen.
Threat intel
Word from the watchtower. "Thieves are after storerooms these days" → a good question. → the friend on the watchtower
Threat hunter
The guard with the lantern. Partner to the guard room that waits for the bell. One waits, one goes looking.
Next story
The Thief and the Guard at One Table →
Want another term as a picture book? Request →