TH0.12 Hunting Maturity Models

Where you are determines what you do next

The Hunting Maturity Model, originally defined by David Bianco at Sqrrl (now Amazon) and widely adopted by the SANS community, defines five levels. Most organizations are at HMM0 or HMM1. That is not a criticism — it is the statistical reality. Knowing your level prevents you from attempting Level 3 activities when Level 1 prerequisites are missing.

HMM0 — Initial: no routine data collection or analysis

The organization relies entirely on automated alerting. When an alert fires, someone investigates. When no alert fires, no one looks. There is no proactive component. No analyst time is dedicated to examining data that has not already triggered a rule.

Most organizations that have deployed Defender XDR and Sentinel but have not formalized proactive operations are at HMM0. The tooling exists. The intent to detect threats exists. The proactive capability does not.

What moves you to HMM1: Ingest the minimum data sources from TH0.10 into a centralized platform (Sentinel or Defender XDR Advanced Hunting). Ensure an analyst can query the data interactively — not just through automated rules.

HMM1 — Minimal: data is searchable, hunting is ad hoc

The data is in Sentinel. An analyst can open Advanced Hunting and run queries. But hunting happens reactively — someone reads a threat report and runs a one-off query, or an incident investigation prompts a wider search. There is no scheduled cadence, no hypothesis backlog, no documentation standard, and no detection rule output from hunts.

This is where many organizations live after deploying a SIEM. The capability to hunt exists. The discipline to hunt does not.

What moves you to HMM2: Establish a structured hunting process. This means: a documented hypothesis generation method (TH1.1), a defined scope standard (TH1.2), an iterative query methodology (TH1.3), a hunt documentation template (TH1.7), and protected analyst time (TH0.8 prerequisite 5). This course provides all of these. Completing TH0 through TH3 and executing your first campaign moves you from HMM1 to HMM2.

HMM2 — Procedural: structured, repeatable hunting process

Hunting follows a documented methodology. Hypotheses are generated from defined sources. Hunts are scoped, executed, analyzed, documented, and — critically — produce detection rules. There is a hunt backlog. There is a cadence (even if modest). Hunt records exist and can be reviewed.

HMM2 is the target for this course. An organization that completes the Hunt Cycle methodology (TH1) and executes campaign modules (TH4–TH13) with documented outputs is operating at HMM2.

What moves you to HMM3: Integrate threat intelligence systematically into hypothesis generation. Automate frequently-run hunts as scheduled queries. Build UEBA baselines that generate hypotheses automatically. Track program metrics (TH0.7) and report to leadership. TH14 and TH16 cover the operational and automation content for this transition.

HMM3 — Innovative: TI-driven hunting with automation

Threat intelligence drives hypothesis generation systematically — not ad hoc reading of blogs, but structured TI consumption that produces backlog items within 48 hours of relevant reports. Frequently-executed hunts are automated as scheduled queries (not full analytics rules — they require analyst review but run without manual initiation). Behavioral baselines are deployed and anomalies feed the hunting pipeline. Program metrics are tracked and reported.

Few organizations reach HMM3 without dedicated hunting resources or a mature security operations function.

What moves you to HMM4: Full automation of the hunting pipeline. New hypotheses are generated from TI feeds automatically. Hunt queries are deployed as continuous monitoring. The hunt-to-detection pipeline operates without manual intervention for well-understood technique categories. Human analysts focus on novel hypotheses and edge cases that automation cannot address.

HMM4 — Leading: continuous, automated hunting

The organization has automated the routine hunting activities and focuses human effort on novel, creative hypothesis generation and investigation of the most complex threats. This level is rare — it requires mature automation, rich data, and a team that has been hunting long enough to have automated the repeatable patterns.

Most organizations should not target HMM4 immediately. It is the long-term outcome of a program that starts at HMM1–HMM2 and matures over years.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

// Quick maturity indicator: do you have evidence of proactive hunting?
// Hunt-derived detection rules are the clearest indicator
SecurityAlert
| where TimeGenerated > ago(365d)
| where ProviderName == "ASI Scheduled Alerts"
| where AlertName startswith "HUNT-"
| summarize
    HuntDerivedRules = dcount(AlertName),
    EarliestRule = min(TimeGenerated),
    LatestRule = max(TimeGenerated)
// HuntDerivedRules = 0 → HMM0 or HMM1 (no hunt-to-detection output)
// HuntDerivedRules = 1-5 → HMM1-HMM2 (some structured hunting)
// HuntDerivedRules = 6+ and spread over months → HMM2+ (sustained program)
// This is a proxy — actual maturity assessment uses all criteria above

Figure TH0.12 — Hunting Maturity Model. Most organizations are at HMM0–HMM1. This course targets HMM2 (structured, documented, producing detection rules). HMM3–HMM4 are covered in TH14–TH16.

References Used in This Subsection

• Bianco, David. “A Simple Hunting Maturity Model.” Sqrrl / SANS. — original HMM framework
• SANS Institute. “Threat Hunting Maturity Model.” — verify URL for current version
• Course cross-references: TH0.8 (prerequisites), TH0.10 (data sources), TH1 (methodology), TH14–TH16 (operations and automation)