## What is Threat Hunting?

**Threat Hunting** is the proactive search for cyber threats that are lurking undetected in a network.

### The Problem with Passive Defense
Traditional security (SIEM, EDR, IDS) is **Reactive**.
*   It waits for an alarm to go off.
*   "If Signature X matches, Send Alert."
*   **The Flaw**: Sophisticated attackers (APTs) use custom tools and "Living off the Land" techniques (PowerShell, WMI) that do NOT trigger signatures. They can dwell in a network for **months** (Average Dwell Time is ~200 days).

### The Hunter's Mindset
Threat Hunting is **Proactive**.
*   **Analogy**:
    *   **Reactive**: Waiting for your burglar alarm to ring.
    *   **Proactive**: Walking around your house with a baseball bat, checking under the beds, even though the alarm didn't ring.
*   **Assumption**: "We are already compromised. I just haven't found it yet."

### Who hunts?
*   It requires a human analyst. AI cannot hunt (yet) because hunting requires **Creativity** and **Intuition**.
*   "That admin logged in at 2 AM. It's not an alert because he *is* an admin. But I know he's on vacation in Hawaii. That's suspicious."

### The Three Pillars of Hunting
1.  **Triggers**: What starts a hunt? (Intel, Hypothesis).
2.  **Data**: You can't hunt what you can't see. (Logs).
3.  **Tools**: SIEM, EDR, Jupyter Notebooks.