Designs, reviews, and documents evidence-scoped threat hunts for Cortex XSIAM or Cortex XDR. Use for hypothesis-driven hunting, baseline and scope planning, ATT&CK interpretation, telemetry-gap analysis, pivot and timeline design, negative-result reasoning, or detection-opportunity handoff. Does not claim tenant observations, invent XQL schemas, operate production controls, or treat an indicator or ATT&CK label as proof of compromise.
