## Data Sources for Hunting

You generally need three types of data to hunt effectively.

### 1. Process Execution (Endpoint is King)
*   **What**: Windows Event 4688 / Sysmon Event 1 / EDR Data.
*   **Why**: Shows exactly what ran.
*   **Hunt**:
    *   "Show me processes running from `Temp` or `Downloads` folders."
    *   "Show me `svchost.exe` without a parent of `services.exe`."

### 2. Network Connections ( The Wire)
*   **What**: Firewall logs, Proxy logs, DNS logs.
*   **Why**: Shows C2 and Exfiltration.
*   **Hunt**:
    *   "Show me long connections (> 4 hours)."
    *   "Show me connections to countries where we have no business."
    *   "Show me user laptops connecting directly to other user laptops (Peer-to-Peer lateral movement)."

### 3. Authentication Logs (Identity)
*   **What**: Windows 4624/4625, VPN logs, Azure AD Sign-ins.
*   **Why**: Shows stolen credentials.
*   **Hunt**:
    *   "Show me a user logging in from 2 different cities in 1 hour."
    *   "Show me a Service Account logging in interactively (Service accounts should be batch/service types, not humans typing passwords)."

### Quality vs. Quantity
More logs is not always better.
*   **Retention**: Hunting requires history. If you only keep 7 days of logs, you can't find an attacker who got in last month.
*   **Granularity**: Firewall logs showing "Block" are useless for hunting. You need the "Allow" logs to find the successful attacker.