## What is Threat Hunting?\n\n**Threat Hunting** is the proactive, iterative search through networks to detect and isolate advanced threats that evade existing security solutions.\n\n### Reactive vs Proactive Security\n\n| Approach | Description |\n|----------|-------------|\n| **Reactive** | Wait for alerts, then investigate |\n| **Proactive** | Assume breach, actively search for threats |\n\n### Why Hunt?\n\n- Attackers have average **dwell time of 200+ days**\n- Signature-based detection misses novel attacks\n- APTs specifically evade automated detection\n- Discover gaps in detection coverage\n- Find threats before impact\n\n### The Hunting Mindset\n\n```\n"Assume compromise. Prove otherwise."\n```\n\n### Hunting Maturity Model (HMM)\n\n| Level | Description |\n|-------|-------------|\n| **HMM0** | Initial - Relies on automated alerts |\n| **HMM1** | Minimal - Uses IOC searches |\n| **HMM2** | Procedural - Follows hunting procedures |\n| **HMM3** | Innovative - Creates new hypotheses |\n| **HMM4** | Leading - Automates successful hunts |\n\n### Key Requirements\n\n✅ Quality log data (visibility)\n✅ Threat intelligence (context)\n✅ Skilled analysts (expertise)\n✅ Time and management support\n✅ Hypothesis-driven methodology