Threat Hunting

Most alerts are looked at one at a time. But the real story is often a pattern across many incidents that no single alert reveals, the same user showing up in ten incidents over two weeks, or one IP address touching several. CloudPeek's Threat Hunting worker looks for exactly these patterns and surfaces them as leads for an analyst to review.

What it does

On a schedule (roughly hourly), the Threat Hunting worker scans your recent incidents per tenant, applies a set of detection rules, and produces lead bundles, deterministically scored findings that highlight a cross-incident pattern worth a human's attention.

Examples of the kind of pattern it surfaces:

• The same user appearing across an unusual number of incidents in a time window.
• A recurring IP address, host or indicator linking otherwise separate incidents.
• Clusters that suggest a single campaign behind many alerts.

It recommends, it doesn't act

Threat Hunting is intentionally advisory:

• It scores and surfaces patterns; it does not automatically create investigations, escalate, or change any incident's state.
• A human reviews each lead and decides whether to act on it (for example by starting an investigation).

This keeps a person in control of what becomes active work, consistent with CloudPeek's Human-in-the-Loop philosophy.

Hunt rules

The detection rules that drive threat hunting are managed in Settings → Hunt Rules (/admin/settings/hunt-rules), "the detection rules that surface lead bundles across your incident stream." From there an administrator can activate or disable individual rules to tune what the hunter looks for. Rules can also be authored and simulated before being switched on.

Working leads

Leads appear for analyst review. A typical flow:

1. Threat Hunting produces leads from the latest scan.
2. An analyst reviews a lead and the incidents behind it.
3. If it warrants deeper work, the analyst promotes it into an investigation.

(The Operations API and threat-hunting endpoints expose leads and runs programmatically if you want to integrate them elsewhere.)

Why deterministic scoring matters

The scoring is deterministic, the same incidents always produce the same lead score. That makes leads predictable and explainable, which matters in high-consequence and regulated environments where "why did this surface?" needs a clear answer.

Related

• Incident Management: the Clusters view groups related incidents.
• Admin & Settings: enabling and disabling hunt rules.
• Background Workers: where threat hunting fits among the workers.