A busy network produces millions of sessions a day. No single one looks malicious on its own. Attacker traffic blends in with backups, SaaS clients, and everyday browsing.
Reading every session isn’t an option. This guide shows how the NetWitness hunting method shrinks the data first, so analysts investigate only what’s left.
What’s Inside
- The six-stage hunting funnel. How each stage removes sessions that don’t matter, from a fixed time window to payload reconstruction.
- The Hunting Labyrinth. A map of outbound, inbound, and lateral traffic with two signals to check for each protocol, from TLS and DNS to Kerberos and SMB.
- A setup check. The direction misconfiguration that quietly skews hunts, and how to avoid it.
Why the Method Works
- It shrinks the problem first. In a worked hunt, hundreds of thousands of sessions come down to three.
- Detection is built in. NetWitness parsers flag protocol oddities as traffic is parsed, so analysts don’t write logic from scratch.
- Nothing is escalated on a filter match. Payload reconstruction proves what happened before it goes up the chain.
- It’s repeatable. Every analyst hunts the same way, so results don’t depend on who’s on shift.
Hunt with a method, not a hunch..