Talk:Cyber threat hunting

This article is within the scope of WikiProject Computer Security, a collaborative effort to improve the coverage of computer security on Wikipedia. If you would like to participate, please visit the project page, where you can join the discussion and see a list of open tasks.Computer SecurityWikipedia:WikiProject Computer SecurityTemplate:WikiProject Computer SecurityComputer Security articles

???

This article has not yet received a rating on the project's importance scale.

This article is supported by WikiProject Computing.

Things you can help WikiProject Computer Security with:

Article alerts will be generated shortly by AAlertBot. Please allow some days for processing. More information...

Review importance and quality of existing articles
Identify categories related to Computer Security
Tag related articles
Identify articles for creation (see also: Article requests)
Identify articles for improvement
Create the Project Navigation Box including lists of adopted articles, requested articles, reviewed articles, etc.
Find editors who have shown interest in this subject and ask them to take a look here.

The footnote [1] refers to a magazine article that refers to a primary vendor document at https://sqrrl.com/solutions/cyber-threat-hunting/ . I think it would be more honest to use the SQRL paper as reference.

The Wikipedia entry seems to focus very heavily on "network-based" hunting, but the reality is that threat hunting can be conducted on the network level, but is more often (these days) conducted at the endpoint level. Additionally, there are mention of indicators, but most threat hunting is going to be conducted using behavioral detections vs pure indicators. — Preceding unsigned comment added by S0upy (talk • contribs) 14:21, 15 January 2021 (UTC)[reply]