How does proactive threat hunting differ from traditional detection, and what methodologies are used?

• A. It relies on alerts and rules.
• B. It is reactive to incidents.
• C. Threat hunting is hypothesis-driven and proactive, using baselining, anomaly detection, TTP hunts, and data analytics.
• D. It ignores telemetry data.

Answer: (C)

Threat hunting is proactive and hypothesis-driven. It starts with a theory about how an attacker might operate in your environment and then you actively search for evidence to confirm or disprove it before a full-blown incident occurs. The key methods include baselining normal behavior so you can spot what’s unusual, using anomaly detection to flag deviations from that baseline, conducting TTP hunts that chase after specific attacker techniques and procedures, and applying data analytics to correlate signals across endpoints, networks, and logs. This approach contrasts with traditional detection, which mainly relies on alerts and rules and tends to be reactive—waiting for an incident or a triggered indicator to surface. It also depends on telemetry from multiple data sources to uncover hidden or stealthy threats.