Defining "bad"
Thresholds need to be established, along with appropriate triggers, regarding how and when to consider that the collected evidence is interesting enough for an analyst to dig deeper into or when it should be handed off to local defenders to follow up. This should be based upon the organization's threshold and level of risk acceptance, along with the defined purpose of the threat hunt. While a data point that is observed could clearly be of a malicious nature, if it does not pose a suitable risk to the organization and does not align with the intention of the hunt, then it will not meet the definition of "bad" as far as the threat hunters are concerned. All of these ideas and considerations should be defined within the hunt plan.
Real-World Example
During a threat hunt, a team was reviewing network traffic and was seeing communication traffic between internal hosts and a few different known botnets. While this is most definitely malicious...
