Use when you want to proactively hunt for threats the alerts missed — framing a testable hypothesis, searching the telemetry to prove or kill it, and turning findings into detections.
