Which three are threat hunting activities? (Choose three answers)

Threat hunting is a proactive, iterative process used by SOC analysts to detect advanced threats that evade automated security defenses. The core activities of a standard threat hunting loop include generating a hypothesis based on threat intelligence or environmental knowledge (identifying what to look for). Once a hypothesis is formed, analysts perform deep investigations, such as packet analysis and log querying, to uncover hidden anomalies. Finally, analysts enrich records with threat intelligence to contextualize their findings, validate the hypothesis, and understand the scope of the potential compromise.

B. Automate workflows: Workflow automation is a function of Security Orchestration, Automation, and Response (SOAR) for incident management, not a direct proactive threat hunting investigative activity.

E. Tune correlation rules: Tuning rules is a reactive SIEM maintenance task or a post-hunt outcome used to improve future automated detection, rather than the active hunting process itself.

1. Fortinet NSE 7 - Security Operations 7.6 Study Guide, Chapter 4: Threat Hunting, Section: Threat Hunting Methodology.

2. SANS Institute. (2019). "Threat Hunting: Open Season on the Adversary." SANS Reading Room.

3. Fortinet FortiSIEM 6.7 User Guide, Chapter: Analytics and Threat Hunting.