During which phase of the Threat Hunting Process are potential threats investigated in depth?

The threat hunting process is a proactive, iterative cycle designed to uncover hidden threats. After a hunter forms a testable theory in the Hypothesis Generation phase, the process moves to the Investigation and Validation phase. This is the core stage where the hypothesis is actively tested through in-depth analysis of security data. Hunters use various tools and techniques to search for specific indicators of compromise (IOCs) or tactics, techniques, and procedures (TTPs) that would prove or disprove the hypothesis. This deep-dive validation is critical to confirm a potential threat before any response actions are initiated.

A. Data Acquisition: This foundational phase involves collecting and normalizing data from sources like endpoints and networks; it precedes the actual in-depth investigation of a specific threat.
B. Data Analysis: This is a general activity or skill set used during the investigation phase, not the name of the specific phase dedicated to the in-depth examination itself.
C. Hypothesis Generation: This is the initial phase where a hunter formulates a theory about a potential threat. The investigation to test this theory happens in the subsequent phase.

1. Cisco Official Blog. Lee, M. N. (2019, October 2). A Framework for Cyber Threat Hunting. Cisco Blogs. This article outlines a four-stage framework: Hypothesizing, Investigating, Uncovering, and Informing. It explicitly states, "The investigating phase of the hunt is where the hunter will attempt to prove or disprove their hypothesis," confirming this is the in-depth analysis stage.

2. Carnegie Mellon University, Software Engineering Institute (SEI). Schultz, T. P. (2018, December 18). Defining the Threat-Hunting Process. SEI Blog. The post describes the process where, after forming a hypothesis, the hunter "begins the investigation by searching for the data that will confirm or deny the hypothesis." This aligns with investigation being the in-depth phase.

3. SANS Institute Whitepaper. Lee, R. M., & Bianco, D. J. (2016). Generating Hypotheses for Successful Threat Hunting. SANS Institute. Page 4, "The Hunting Process." This paper details the hunting loop, showing that after a hypothesis is created, the next step is to "Investigate the hypothesis through data analysis" to find supporting or refuting evidence.