Threat Hunting
Hypotheses generated nightly. Findings waiting at 8am.
ManySignal's hunting engine generates ATT&CK-mapped hypotheses tuned to your environment, tests them against 90 days of indexed telemetry overnight, and delivers structured hit reports to your team — no blank dashboards.
A day in the life of threat hunting
What actually happens between when your team leaves and when they return the next morning.
00:00
Hypothesis generation
ManySignal's threat hunting engine analyzes your environment telemetry and ATT&CK coverage gaps daily. At midnight, it generates 10–15 hunt hypotheses tuned to your specific asset profile — cloud-heavy, identity-first, or endpoint-dense — not generic queries from a static library.
00:30
Query execution
Hunt queries run against 90 days of indexed telemetry simultaneously. The engine tests for living-off-the-land binaries, credential harvesting patterns, anomalous lateral movement, and data staging behaviors specific to your environment baseline.
02:15
Hit analysis
When a query returns results, the Investigate agent evaluates each hit: Is the process or behavior expected for this asset? Does it correlate with other anomalies? Is there a known ATT&CK technique match? The agent assembles a hit report with the supporting evidence.
08:00
Morning brief
Your team arrives to a structured hunting brief: overnight hypotheses tested, hits that produced findings, evidence package per hit, and recommended follow-on investigation steps. No blank dashboards, no raw query output to interpret.
08:45
Analyst review and decision
An analyst reviews the hit reports, approves or closes each one, and optionally converts a confirmed finding into a case with a response workflow. The whole review takes 20–30 minutes for a typical overnight hunt session.
Sample hunt query — Credential Dumping via LSASS
ManySignal detection DSL. AI-generated from ATT&CK T1003.001 coverage gap analysis.
-- ATT&CK T1003.001: OS Credential Dumping: LSASS Memory
-- Generated: 2025-08-09 | Confidence: HIGH
HUNT credential_dump_lsass
FROM endpoint.process_events
WHERE
target_process_name = 'lsass.exe'
AND action IN ('memory_read', 'handle_open')
AND source_process_name NOT IN (
'MsMpEng.exe', 'csrss.exe', 'services.exe',
'winlogon.exe', 'wininit.exe'
)
GROUP BY host_id, source_process_name, user_name
HAVING COUNT(*) > 3
WINDOW 15m
ANNOTATE WITH entity_risk_score, peer_group_deviation
EMIT AS finding WITH severity=HIGH, technique='T1003.001'What continuous threat hunting delivers
10–15 new hypotheses per night
Generated from your ATT&CK coverage gaps and current threat intelligence — not a static library of generic queries.
90-day telemetry index for every hunt
Long-horizon queries catch slow-moving threats that single-day queries miss. Historical data is always available for re-hunting.
Structured hit reports, not raw output
The Investigate agent interprets hunt results and delivers a brief your team can act on in 20 minutes.
ATT&CK coverage map updated weekly
The hunting engine tracks which techniques have active detection rules and which have hunting coverage. Gaps drive new hypothesis generation.
Custom hypotheses alongside AI-generated ones
Your team's institutional knowledge about adversary behavior can be encoded as custom hypotheses that run every night.
Findings enter the standard response pipeline
Confirmed hunt findings become cases with the full triage and response workflow — no separate process for hunting-sourced threats.
Threat hunting — common questions
How are hunt hypotheses generated?
Hypotheses are generated from three inputs: your ATT&CK coverage map (which techniques lack detection coverage), your entity graph (which assets are high-value but under-monitored), and current threat intelligence (which adversary groups are active in your industry vertical). The result is hypotheses tuned to your actual risk surface, not a generic hunt library.
What query language do hunt queries use?
Hunt queries use ManySignal's detection DSL, which compiles to the underlying data store query language. Analysts can view, edit, and export queries. YARA-L and Sigma format imports are supported for existing hunt libraries.
How long does the telemetry index cover?
Hot storage covers 12 months by default, with unlimited cold storage for older events. Hunt queries run against the full hot index. Cold storage queries can be scheduled for longer-horizon investigations.
Can we build our own hunt hypotheses?
Yes. Analysts can create custom hypotheses using the hunt builder UI or by importing Sigma-format detection logic. Custom hypotheses run alongside AI-generated ones. The system tracks hypothesis performance over time — how often each fires and how many findings it produces.
What happens when a hunt finds something real?
The Investigate agent assembles a full case from the hunt finding: the matched evidence, correlated events, entity history, and MITRE technique mapping. The case enters the standard triage-and-response pipeline, including approval-gated containment options.
How is ManySignal threat hunting different from running queries in a SIEM?
SIEM threat hunting requires manual hypothesis formulation, query writing, and result interpretation — all analyst-driven. ManySignal's hunting engine generates hypotheses automatically from your coverage map and threat intelligence, executes queries overnight, and delivers structured hit reports with pre-interpreted evidence. Analysts spend their time reviewing findings, not writing queries. The manual query capability is still available for analysts who prefer it.
What data sources are available for threat hunting, and how far back does the data go?
All connected data sources are available for hunt queries — endpoint telemetry, identity events, cloud activity, network logs, and SaaS audit logs. Hot storage indexes 12 months of events with sub-second query response for most query types. Cold storage retains events beyond 12 months with scheduled query support. The hunt engine runs queries across all sources simultaneously, correlating results in the entity graph.
Can threat hunt findings be automatically converted into new detection rules?
Yes. When an analyst confirms a hunt finding as a true positive, ManySignal offers a one-click workflow to convert the hit logic into a persistent detection rule. The proposed rule is pre-populated from the hunt query and runs in alert-only mode initially, allowing the detection engineer to validate precision before promoting it to active escalation. This closes the gap between threat hunting and permanent detection coverage.
How does ManySignal prioritise which hypotheses to run when there are dozens of possible hunt paths?
Hypothesis prioritisation uses a scoring model: techniques with no existing detection coverage score highest, techniques with recent intelligence confirming active adversary use in your industry score higher, and techniques targeting your highest-value assets score higher than those targeting commodity assets. The overnight hunt session runs the top-scored hypotheses within the available compute window. Analysts can pin specific hypotheses to always run regardless of score.
See a hunt brief built from your environment
Connect your telemetry sources and we'll generate a sample overnight hunt brief — real hypotheses, real query logic, real evidence structure — customized to your asset profile.