{"id":14753,"date":"2026-03-23T02:02:20","date_gmt":"2026-03-23T06:02:20","guid":{"rendered":"https:\/\/www.netwitness.com\/?post_type=glossary&p=14753"},"modified":"2026-04-07T05:07:26","modified_gmt":"2026-04-07T09:07:26","slug":"threat-hunting","status":"publish","type":"glossary","link":"https:\/\/www.netwitness.com\/ko\/cyber-glossary\/threat-hunting\/","title":{"rendered":"Threat Hunting"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

What is Threat Hunting?<\/h2>\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Threat\u00a0hunting\u00a0is the practice of proactively searching through networks, endpoints, and data sets to\u00a0identify\u00a0hidden\u00a0threats that have evaded automated security controls.\u00a0Unlike reactive alert-driven workflows,\u00a0threat\u00a0hunting\u00a0begins with a hypothesis\u00a0or\u00a0an educated assumption about where an attacker might be operating.\u00a0It then works outward to\u00a0validate\u00a0or refute that hypothesis using telemetry data.<\/span>\u00a0<\/span><\/p>

A\u00a0threat\u00a0hunter does not wait for an alert to investigate. Instead, they actively query logs, analyze behavioral patterns, and trace lateral movement across the environment. This discipline acknowledges a critical reality in modern cybersecurity: detection tools, no matter how sophisticated, will miss some\u00a0threats.\u00a0Threat\u00a0hunting\u00a0closes that gap through skilled human analysis.<\/span>\u00a0<\/span><\/p>

Threat\u00a0hunting\u00a0sits at the intersection of data analysis, adversary knowledge, and investigative reasoning. It requires familiarity with attacker tactics, techniques, and procedures (TTPs), as well as the ability to extract meaningful\u00a0signal\u00a0from large volumes of security telemetry,\u00a0including network traffic, endpoint events, identity logs, and cloud activity.<\/span><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Synonyms<\/h2>\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t