Threat hunting
Proactively searching telemetry for attacker activity that existing detections missed, usually starting from a testable hypothesis.
A hunt starts with a hypothesis grounded in intel or ATT&CK ("an attacker with domain user access is Kerberoasting service accounts"), identifies the data that would show it, queries and baselines it, and investigates outliers. The output is either a finding or, just as valuable, a new detection, a logging gap fixed, or documented evidence of absence.
It differs from triage (reacting to alerts) and from IOC sweeps (matching known indicators), though both feed it. Stacking (counting rare values across the fleet) and long-tail analysis are core techniques.
Hunts fail when they have no hypothesis, lack the needed data, or end without converting what was learned into automated detection.