In this section
TH0.12 Hunting Maturity Models
Where you are determines what you do next
The Hunting Maturity Model, originally defined by David Bianco at Sqrrl (now Amazon) and widely adopted by the SANS community, defines five levels. Most organizations are at HMM0 or HMM1. That is not a criticism — it is the statistical reality. Knowing your level prevents you from attempting Level 3 activities when Level 1 prerequisites are missing.
HMM0 — Initial: no routine data collection or analysis
The organization relies entirely on automated alerting. When an alert fires, someone investigates. When no alert fires, no one looks. There is no proactive component. No analyst time is dedicated to examining data that has not already triggered a rule.
// Quick maturity indicator: do you have evidence of proactive hunting?
// Hunt-derived detection rules are the clearest indicator
SecurityAlert
| where TimeGenerated > ago(365d)
| where ProviderName == "ASI Scheduled Alerts"
| where AlertName startswith "HUNT-"
| summarize
HuntDerivedRules = dcount(AlertName),
EarliestRule = min(TimeGenerated),
LatestRule = max(TimeGenerated)
// HuntDerivedRules = 0 → HMM0 or HMM1 (no hunt-to-detection output)
// HuntDerivedRules = 1-5 → HMM1-HMM2 (some structured hunting)
// HuntDerivedRules = 6+ and spread over months → HMM2+ (sustained program)
// This is a proxy — actual maturity assessment uses all criteria aboveTry it yourself
Exercise: Assess your organization's hunting maturity
Answer yes or no to each:
Is hunting data searchable by analysts interactively (not just through automated rules)? If no → HMM0.
Have analysts run hunt queries in the last 90 days? If yes but without a documented methodology, backlog, or cadence → HMM1.
Does hunting follow a documented methodology with hypothesis generation, scoping, collection, analysis, conclusion, and detection rule conversion? Are hunt records produced for every campaign? → HMM2.
Is threat intelligence systematically integrated into hypothesis generation? Are frequently-run hunts automated? Are program metrics tracked? → HMM3.
Is the hunting pipeline continuous and automated, with human effort focused on novel hypotheses? → HMM4.
Your current level determines which modules in this course to prioritize. HMM0→HMM1: focus on TH0.8 prerequisites and TH0.10 data sources. HMM1→HMM2: focus on TH1 (methodology) and TH3 (backlog). HMM2→HMM3: focus on TH14–TH16 (operations and automation).
Applying the model honestly
The most common misuse of hunting maturity models is aspirational self-assessment. A team that runs scheduled KQL queries from a shared library is at HMM1 (minimal hunting) — not HMM3 (innovative), regardless of what the team believes. The test is simple: when was the last time a hunt produced a finding that no existing detection rule would have caught? If the answer is "never" or "months ago," the team is executing queries, not hunting. Genuine hunting requires a hypothesis that the current detection library does not cover, a data source that existing rules do not query, and an analytical approach that goes beyond threshold comparison. The maturity model measures capability, not aspiration.
The model also helps set realistic expectations with leadership. A team at HMM1 will not produce original threat intelligence findings. Promising HMM4 capabilities from an HMM1 team creates expectations that cannot be met, eroding leadership confidence in the program. Instead, present the current maturity level honestly and define the investment (training, tooling, time allocation) required to advance one level per quarter. Four quarters of measurable progress builds more leadership confidence than one quarter of overpromised results.
The myth: Regulatory frameworks require advanced, TI-driven, automated hunting. HMM2 is not sufficient for compliance.
The reality: No mainstream regulatory framework specifies a hunting maturity level. What frameworks require is evidence of proactive threat monitoring — which HMM2 satisfies. A documented hunting methodology, a backlog of hypotheses, completed hunt records with findings, and detection rules produced from hunts constitute strong evidence for ISO 27001 (A.5.25), NIST CSF 2.0 (DE.CM, DE.AE), SOC 2 (CC7.2), and PCI DSS 4.0 (Requirement 11). HMM3 and HMM4 are operational maturity goals, not compliance requirements. Reach HMM2 first. Demonstrate value. Advance further when the program justifies it.
Extend this model
The HMM is one of several maturity models used in the hunting community. The MITRE Threat-Informed Defense model focuses on ATT&CK integration. The SOC-CMM (SOC Capability Maturity Model) includes hunting as one of several SOC capability domains. If your organization uses a formal maturity framework for SOC assessment, map the HMM levels to the corresponding capability areas in that framework. The mapping is usually straightforward because the underlying concepts — ad hoc → structured → automated → continuous — apply across models.
References Used in This Subsection
NE environmental considerations
NE's detection environment includes specific factors that influence this rule's operation:
Device diversity: 768 P2 corporate workstations with full Defender for Endpoint telemetry, 58 P1 manufacturing workstations with basic cloud-delivered protection, and 3 RHEL rendering servers with Syslog-only coverage. Rules targeting DeviceProcessEvents operate with full fidelity on P2 devices but may have reduced visibility on P1 devices. Manufacturing workstations in Sheffield and Sunderland represent a detection gap for endpoint-level detections.
You have time for one hunt this quarter. Do you hunt for the threat in the latest advisory or for the gap in your ATT&CK coverage matrix?
Hunt the coverage gap. Advisories describe threats that are CURRENT but may not target NE. Coverage gaps describe techniques that COULD target NE and would succeed undetected. The coverage gap hunt produces a detection rule (closing the gap permanently). The advisory-driven hunt produces a point-in-time assessment (confirming the specific threat is not present today). Both are valuable — but the coverage gap hunt has a longer-lasting impact because it produces a permanent detection improvement.
You understand the detection gap and the hunt cycle.
TH0 showed you what detection rules fundamentally cannot catch. TH1 gave you the hypothesis-driven methodology that closes that gap. Now you run the hunts.
- 10 complete hunt campaigns — from hypothesis through KQL execution through finding disposition, each campaign based on a real TTP
- 70 production hunt queries — every one mapped to MITRE ATT&CK and tested against realistic telemetry
- Advanced KQL for hunting — UEBA composite risk scoring, retroactive IOC sweeps, and hunt management metrics
- Hypothesis-Driven Hunt Toolkit lab pack — 30 days of realistic M365 and endpoint telemetry with multiple attack patterns seeded in
- TH16 — Scaling hunts across a team — the operating model for a production hunt program