Run a hypothesis-driven threat hunt: form a hypothesis (often from ATT&CK or threat intel), query telemetry for evidence, analyze findings, and convert results into detections. Use to proactively search for adversary activity that existing alerts may miss.
