The motivation for hunting and pivoting

Before we dive into the motivation to perform threat hunting and pivoting, we first must examine what those terms mean. As mentioned earlier, threat hunting is a term that is often misunderstood, misrepresented, and misused. In simple terms, threat hunting is looking for threat activity in a network, on a host or server, or in logs, telemetry data, and antifactory datasets. Hunting often starts on the foundation of a goal or hypothesis, which helps dictate a specific first entry point into a hunt. Examined more closely, however, threat hunting often has varied motivations and layers depending on the organizational function and requirements.

Threat hunting is often performed on logs and datasets, with logs sometimes being examined by threat hunting teams typically attached to security operations center (SOC) functions, as an example. It can also be done by employees of organizations wishing to look through organizational telemetry data to...