Security Operations Tools
Threat Hunting Reference
Search threat hunting methodologies and concepts. Covers hypothesis-driven hunting, TTP-based hunting, IOC hunting, analytics-driven hunting, and hunting maturity levels.
Calculations run locally in your browserTool
About this tool
Threat Hunting Reference
The Threat Hunting Reference covers hypothesis-driven, TTP-based, IOC-driven, and analytics-driven hunting methodologies with hunting maturity model.
• Look up hypothesis-driven hunting methodology before planning a hunting sprint
• Reference ATT&CK-based TTP hunting before a targeted threat hunt
• Find hunting maturity levels before a security program assessment
• Reference analytics-driven hunting before evaluating ML-based hunting tools
Next step
Attack Surface Calculator — Calculate external attack surface score from internet-facing services, open ports, and unprotected accounts.
Open Attack Surface Calculator →
FAQ
What does this tool tell you?
The Threat Hunting Reference covers hypothesis-driven, TTP-based, IOC-driven, and analytics-driven hunting methodologies with hunting maturity model.
What affects the result most?
Threat hunting: proactive search for threats not caught by automated detection — assumes breach. Hypothesis-driven hunting: start from ATT&CK technique hypothesis, search for evidence. IOC-driven hunting: search for known bad indicators — lower skill, narrow scope.
How should I use the result?
Use this tool to orient quickly to the concepts, field names, or values you are about to look up in a full specification or vendor documentation. It summarizes the common cases; the authoritative source remains whichever standard or vendor doc defines the values themselves.