How is this different from a penetration test or red team?

Opposite directions. A pentest simulates the adversary getting in; a hunt searches for the adversary who may already be in. Red team output actually feeds hunting — proven attack paths become hunt hypotheses. If you want both sides of that loop, the offensive catalog and the hunt cycles are designed to hand off to each other.

What do you need from us?

Read-only access to your telemetry — SIEM, endpoints, network, and cloud logs — over secure VPN, a named point of contact, and at least 30 days of log history. No agents deployed, no configuration changed, no tooling purchased. If your log coverage is thin, we tell you before the engagement starts, not in the final report.

What happens if you find an active compromise?

You hear about it immediately — not in the quarterly report. We escalate with evidence, severity, and a recommended containment path; the decision to act stays with you. Incident response and forensics engage under their own scope if you want hands on keyboards. Hunting agreements never quietly become response invoices.

Do we keep the queries and playbooks?

Yes — handover is the point. Each cycle delivers 10–20 custom KQL/Sigma queries and condensed playbooks written for your environment, 40–60 artifacts across a year. Your team reruns them, adapts them, and builds detections from them. The hunt ends; the capability stays.

Which cadence is right for us?

Core (quarterly) suits organizations that need documented assurance and a detection-gap read. Edge (monthly) is the compounding option — most chosen, because hypotheses refine month over month. Apex (weekly) fits institutions with mature internal SOCs that want a standing hunt tempo integrated with their own operations. Every tier opens with the same requirements workshop, and pricing is fixed there.

A Zentara hunter working detection logic on the SOC glass

Threat Hunting · Proactive Detection

Assume breach. Go find it.

Q: We have a SOC watching alerts. Why hunt?

Monitoring answers 'did something we recognize just happen?' Hunting answers 'is something we don't recognize already here?' Alerts are reactive by design — they fire on known signatures and thresholds. A hunt starts from the assumption of breach and searches for the tradecraft that never trips an alert: living-off-the-land techniques, slow lateral movement, insider activity. The two are complementary — and validated hunt findings become new detections for the watch.

Hypothesis-driven hunts by Zentara's SOC bench — AI-augmented, ATT&CK-mapped, run in your own telemetry.

APTs, insider activity, and lateral movement live below the alert threshold. Waiting for detections means waiting out a 200-day dwell time. A hunt doesn't wait for the alert — it goes looking for the adversary who never triggers one.

Scope a Hunt Compare hunt cadences

5–10

Hypotheses hunted and adjudicated per cycle

≥30%

Dwell-time reduction target in the first cycle

40–60

Queries & playbooks handed over across a year

Certified & audited operations

Verify at our trust centre

The gap

Alerts wait. Hunters look.

Industry dwell-time studies put the gap between intrusion and discovery in months, not minutes — because the intruders worth worrying about are engineered not to trip an alert.

The alert threshold

Automated detection fires on what it already knows. Novel tradecraft, living-off-the-land techniques, and slow-moving campaigns sit below it — indefinitely.

The quiet adversary

APTs, insiders, and lateral movement are engineered to look like normal operations. No alert means nothing — absence of evidence isn't evidence of absence.

The unprovable negative

When the board or the regulator asks 'are we compromised?', a quiet dashboard isn't an answer. Only a documented search is.

The three questions a hunt asks

“If someone were already inside, where would they be standing?”

Hypotheses from your crown jewels and threat profile

“What would their traffic look like in our telemetry?”

Custom queries against your SIEM and EDR — not vendor defaults

“Can we prove what we found — and what we didn't?”

Confidence-rated findings with evidence, ATT&CK-mapped

Absence of alerts is not absence of adversaries.

The hunt loop

Five moves. Every cycle.

Hypothesis-driven and AI-augmented, following MITRE ATT&CK and the Pyramid of Pain — aimed at the indicators adversaries can't cheaply change.

Hypothesize

5–10 hypotheses per cycle, built from your industry threat profile, current intelligence, and what your estate actually holds — not a generic checklist.

Enrich

Telemetry collected and normalized from your logs, endpoints, network, and cloud. AI triage cuts the noise before a hunter spends a minute on it.

Hunt

Custom KQL and Sigma queries executed in your SIEM and EDR, correlated against live threat-intelligence feeds. Hunters drive; automation carries.

Validate & map

Every finding cross-verified, severity-scored, and mapped to MITRE ATT&CK. Hypotheses are adjudicated — validated, refuted, or carried forward. Refuted is a result too.

Hand over

Queries, condensed playbooks, and a debrief with the hunters. Findings feed detection engineering — each hunt hardens the next.

Judged on numbers —5–10 validated hypotheses per cycle≥30% dwell-time reduction, first cycle<10% false-positive rate100% audit-ready documentation

Accelerated by Agent ODYSSEY

Zentara hunts run with ODYSSEY's Threat Hunting agent in the loop — building hypothesis hunts from ATT&CK and logging every hunt to shared memory, so each cycle starts smarter than the last. See how the agent works →

What you get

Every hypothesis gets a verdict.

Validated, refuted, or carried forward — a hunt that finds nothing proves something. The report is written so an auditor, a director, or your next hire can retrace it.

Zentara_Threat_Hunt_Report_[CLIENT]_Q3-2026.pdf — sampleConfidential

Hypothesis register · Cycle Q3

Prepared for: · 214 GB telemetry · 31 days

H-01Credential abuse via anomalous OAuth grantsT1528Validated

H-02Lateral movement over WMI from finance subnetT1047Validated

H-03Exfiltration via DNS tunnelingT1048Refuted

H-04Dormant scheduled-task persistenceT1053Carried fwd

Detection handover — Sigma (excerpt)

title: WMI Lateral Movement from Finance Subnet
status: experimental        # ZTR-TH-Q3-018
logsource:
  product: windows
  service: wmi
detection:
  selection:
    EventID: 5861
    SourceNetwork|startswith: '10.24.'
  condition: selection

Hunter TH-04 · QA: SOC Lead · MITRE ATT&CK v15Page 9 of 31

Hunt reports

Executive summary plus the detailed report — every finding evidence-backed and ATT&CK-mapped, written to survive an audit.

10–20 custom queries per cycle

KQL and Sigma, written for your environment, handed over for internal reuse — 40–60 across a year.

Condensed playbooks

Replicable response playbooks for the scenarios that matter — ransomware precursors, insider risk, credential abuse.

The debrief

The hunters walk your team through what was found, what was ruled out, and what to watch next.

The hunt ends. The capability stays.

Cadence

Three tempos. One methodology.

Every tier runs the same hunt loop — the difference is how often it turns, and how much compounds.

Core

Quarterly hunts

Baseline assurance — a documented search each quarter with standard reporting.

Quarterly hunt cycle
Executive & detailed reports
Query handover

Scope a Hunt

Edge

Most chosen

Monthly hunts

Continuous refinement — hypotheses compound month over month.

Everything in Core
Monthly hunt cycles
Full playbook library
Detection-engineering feedback loop

Scope a Hunt

Apex

Weekly hunts

For institutions with mature security teams running their own SOC.

Everything in Edge
Weekly hunt tempo
Integration with your SOC
Standing quarterly support

Scope a Hunt

Every tier opens with the same requirements workshop — scope and pricing are fixed there, in writing.

Start with one cycle

One hunt cycle. A verdict on every hypothesis.

Read-only access, thirty days of logs, and four to six weeks later you hold evidence-backed findings, custom queries, and playbooks your team keeps — whatever the hunt concludes.

Scope a Hunt Talk to an Expert

Ground rules

What we need. What we won't do.

Hunting works on trust and telemetry. Both get defined before the first query runs.

Your platforms, not ours

We hunt in your SIEM and EDR through read-only access over secure VPN. Nothing to buy, nothing installed, nothing changed.

Thirty days of logs to start

The minimum telemetry for a meaningful first cycle. Thinner than that, and we'll say so — and scope honestly.

Hunting is not remediation

If a hunt surfaces a live intrusion, containment is your call — we escalate immediately with evidence, and IR engages under its own scope.

Weekly check-ins, no surprises

Progress updates every week of the cycle. The final report never contains a finding you're hearing about for the first time.

Build the program

Pairs well with

Managed SOC

Hunts are pulses; a SOC is the standing watch. Validated findings become detection rules your monitoring runs 24/7.

Explore

Incident Response & Digital Forensics

When a hunt finds a live intrusion, response takes over — containment, forensics, and chain-of-custody discipline, engaged on your approval.

Explore

VAPT — Vulnerability Assessment & Penetration Testing

Offensive findings are hunting fuel: the paths our red side proves become the hypotheses the hunt side chases.

Explore

FAQ

Common questions

Straight answers. If yours isn't here, ask us directly.

Monitoring answers 'did something we recognize just happen?' Hunting answers 'is something we don't recognize already here?' Alerts are reactive by design — they fire on known signatures and thresholds. A hunt starts from the assumption of breach and searches for the tradecraft that never trips an alert: living-off-the-land techniques, slow lateral movement, insider activity. The two are complementary — and validated hunt findings become new detections for the watch.