MetisHunter · In development

A threat hunting practice, in development

MetisHunter is being built to help analysts decide what to hunt, record why, and keep what the team learned. It is not available yet and is not part of any plan until it ships.

Notify me when it ships

MetisHunter

In development

Threat hunting as a practice, beside the XDR you already use.

Every XDR and SIEM can search. None of them helps an analyst decide what to look for, records why they looked, or remembers what the team learned. MetisHunter is being built to do that. It is not available yet, and it is not part of any plan until it ships.

Planned: a hunt in five stages

  1. 01

    ObserveThe trigger, the intel, and the data you have and lack

  2. 02

    OrientA hypothesis that could be proved wrong

  3. 03

    DecideThe questions and queries, and what a hit means

  4. 04

    ActEach result, kept as evidence

  5. 05

    LearnFindings, blind spots, lessons and new detections

The same OODA loop MetisLoops trains, with a fifth stage that feeds what the hunt learned into the next one.

  • Planned

    Hypothesis first

    A guided hypothesis: the adversary behavior, the evidence it would leave, and what would prove it wrong. More than an indicator search.

  • Planned

    Organization memory

    Every closed hunt joins a searchable library: what was hunted, what was found, and what the team could not see.

  • Planned

    Program maturity

    A measure of the hunt program, from waiting for alerts to turning hunts into detections, with the next step for each area.

  • Planned

    Audit-ready reports

    Hypotheses, scope, data gaps, evidence, findings and the reviewer's sign-off, in a document an auditor can read.

One method across the platform. Learn the loop in MetisLoops, rehearse it in a MetisForge exercise, then apply it in a hunt.

Hear when MetisHunter ships

Questions

Questions about MetisHunter.

Is MetisHunter available?

No. MetisHunter is in development. It is not available and not part of any plan until it ships. Everything described on this page is planned.

Does MetisHunter replace our XDR or SIEM?

No. It is being built to sit beside the tools you already use. Your XDR or SIEM runs the searches; MetisHunter is for deciding what to look for, recording why, and keeping what the team learned.

How does MetisHunter relate to MetisLoops and MetisForge?

All three use the same OODA loop. Learn the loop in a MetisLoops drill, rehearse it with the team in a MetisForge exercise, then apply it in a hunt.

How do I hear when it ships?

Send a short message through the contact page and choose MetisHunter. The team will email you when it is ready to try.