Alerts tell you what your tools noticed. Threat hunting looks for what they missed. RA-10 Threat Hunting asks you to build that capability. NIST 800-53 binds US federal systems, and others by contract. For everyone else it is a reference, and it usually applies to larger or higher risk teams.
What it means in practice
The statement asks you to establish and maintain a cyber threat hunting capability that searches for indicators of compromise in your systems, and detects, tracks and disrupts threats that evade existing controls. You also employ the capability at a frequency you define.
The guidance calls hunting an active defense, in contrast to firewalls, intrusion prevention, sandboxes and SIEM tools. It means proactively searching systems, networks and infrastructure for advanced threats, with the aim of disrupting adversaries early and improving response speed and accuracy.
A small team can meet the spirit with scheduled hunts: pick a hypothesis, query your logs, record the result.
Evidence to collect
- The hunting procedure and its frequency.
- A log of hunts with hypothesis, data sources, findings and date.
- Findings that became detections, tickets or incidents.
- Staff assigned and their training.
Common gaps
- Hunting happens ad hoc, with no record.
- Log retention is too short to hunt through.
- Findings do not feed back into detection rules.
How to implement it
Schedule a monthly hunt. Take one technique from a public threat framework, write the hypothesis, search the logs, and note the outcome even when it is nothing. Convert good queries into standing alerts. Make sure you keep logs long enough to look back.
Quick check
Is a SIEM alert the same as threat hunting?
No. Alerts fire on known patterns. Hunting is a human led search for activity that evaded those patterns.
