## Hunting vs. Detection: What's the difference?

It is easy to confuse Incident Response, Detection Engineering, and Threat Hunting.

### 1. Detection Engineering (The Ref)
*   **Goal**: Automate the known.
*   **Process**: "I know Emotet uses this registry key. I will write a SIEM rule for it."
*   **Output**: An Alert (Signature).

### 2. Incident Response (The Firefighter)
*   **Goal**: Put out the fire.
*   **Process**: "The SIEM alerted on Emotet! Delete it! Isolate the host!"
*   **Output**: A clean machine.

### 3. Threat Hunting (The Detective)
*   **Goal**: Find the unknown.
*   **Process**: "I wonder if anyone is using PowerShell to download files? There is no rule for it because admins do it too. I will filter the logs and look for anomalies."
*   **Output**:
    1.  **Nothing** (The network is clean).
    2.  **An Incident** (I found a hacker! -> Hand off to IR team).
    3.  **A New Rule** (I found a simplified way to detect this. -> Hand off to Detection Engineers).

### The Cycle
Hunting feeds Detection.
1.  Hunter finds a new attack pattern manually.
2.  Hunter explains it to Detection Engineer.
3.  Engineer writes a rule.
4.  Now the SIEM detects it automatically.
5.  Hunter moves on to the next unknown threat.

**Hunting is not just "looking at logs randomly".** That is called "log staring" and it is useless. Hunting must be structured.