Alert triage vs Threat hunting

Why they differ

Triage reacts to alarms that tools have already raised; hunting starts from a guess and searches for what raised no alarm.

Alert triage

Detection & response

Sorting incoming alarms quickly into real threats, harmless noise and cases that need a closer look, so the worst get handled first.

Formal

The first step of handling an alarm, in which an analyst checks its context, decides whether it points to a real security incident, gives it a priority and either closes it or passes it on - up to management when the harm could be serious.

In plain English

Like the nurse at a hospital's emergency desk who looks at everyone coming in and decides who sees a doctor now, who can wait, and who can go home.

In practice

Of forty overnight alarms in a region's SOC, the analyst closes thirty-five as a known backup job, groups four into one case about a single laptop, and sends the last - an admin login from abroad - straight to the on-call lead.

Why it matters

A team cannot look deeply at every alarm, so the quality of this first sort decides whether a real attack is caught in minutes or lost among hundreds of harmless ones.

Threat hunting

Detection & response

Searching on purpose for attackers who may already be inside the network, without waiting for an alarm to go off.

Formal

A repeated, human-led search through logs and endpoint data that starts from a guess about how an attacker could act, often taken from MITRE ATT&CK, to find activity that detection rules missed, and ends by closing the guess or opening an incident.

In plain English

Like a store detective who walks the floor looking for known tricks, instead of only waiting for the alarm at the door to beep.

In practice

After reading a CFCS report that a criminal group steals passwords with a certain admin tool, a hunter at a pension fund searches three months of endpoint data for it, finds it on one server and hands the case to incident response.

Why it matters

Skilled attackers avoid setting off alarms and can stay hidden for months; hunting cuts that time short, and each hunt that works can become a new detection rule.