Notes on exercising for real incidents.

Threat hunting starts with a question, not a query

Alerts arrive late in an attack. Hunting looks at the quiet steps before them. How to write a hypothesis, choose your data, and keep what each hunt teaches.