In this section
TH1.8 Hypothesis Prioritization and Backlog Management
You cannot hunt everything
The ATT&CK coverage analysis in TH3 will produce 50–80 hypotheses from coverage gaps alone. Threat intelligence adds more. Prior incidents add more. Environmental changes add more. A monthly hunting cadence executes 12 campaigns per year. You need to select the 12 that matter most from a backlog of 100+.
The selection must be systematic, not instinct-driven. "This one feels important" is not a prioritization framework. A scoring model is.
The scoring model
// Identify your highest-gap ATT&CK tactics — these map to Score 3 detection gap severity
SecurityAlert
| where TimeGenerated > ago(90d)
| where ProviderName == "ASI Scheduled Alerts"
| extend Tactics = parse_json(tostring(
parse_json(ExtendedProperties).["Tactics"]))
| mv-expand Tactic = Tactics
| summarize RuleCount = dcount(AlertName) by tostring(Tactic)
// Tactics with the lowest RuleCount (or missing entirely) = highest gap severity
// Cross-reference with the MITRE ATT&CK tactic list to find
// the tactics that DO NOT appear in these results at all
// Those zero-coverage tactics contain your Score-3 hypothesesTry it yourself
Exercise: Score your three hypotheses
Take the three hypotheses from TH1.1 exercise. Score each on the three dimensions (1–3 each). Calculate the composite score. Rank them.
The highest-scoring hypothesis should be your first campaign. If two hypotheses tie, prefer the one with higher Data Availability (score 3) — it is immediately executable with maximum visibility.
The coverage gap method
Prioritise hypotheses by mapping them against existing detection rule coverage. Export the list of analytics rules from Sentinel, map each to its MITRE ATT&CK technique, and identify techniques with zero or minimal detection coverage. These uncovered techniques become the highest-priority hunt hypotheses — they represent threats that the SOC is completely blind to. A hunt against an uncovered technique has the highest probability of producing a unique finding because no automated detection exists to catch the activity first. This method transforms the ATT&CK coverage heat map from a reporting artifact into a hunt prioritization tool.
The queries developed during this exercise become reusable templates in your personal hunting library. Parameterise the hardcoded values (user names, IP addresses, time windows) and add a header comment explaining the hypothesis each query tests. A mature hunting program maintains 50-100 parameterised query templates that any team member can execute — reducing the per-hunt preparation time from hours to minutes and ensuring consistent methodology across analysts.
The myth: The most recent threat intelligence should always drive the next hunt. If a new report comes out today, tomorrow's hunt should test it.
The reality: Recency is not priority. A threat report about a technique that scores 3-3-3 (27) should absolutely drive the next hunt. A threat report about a technique that scores 1-1-2 (2) — low relevance to your sector, data not available, moderate impact — should enter the backlog at low priority regardless of how recent it is. The scoring model prevents recency bias from overriding relevance, availability, and impact. New intelligence updates scores — it does not automatically promote hypotheses to the front of the queue.
Extend this model
Some organizations add a fourth dimension: estimated effort. A high-scoring hypothesis that requires 2 hours of hunting produces faster ROI than one that requires 8 hours. Dividing the composite score by estimated effort produces a "value per hour" metric that helps when choosing between similarly-scored hypotheses. This optimization is useful for mature programs that are managing large backlogs — for initial programs, the three-dimension model is sufficient.
References Used in This Subsection
- Course cross-references: TH1.1 (hypothesis generation), TH3 (ATT&CK coverage analysis as primary backlog source)
NE environmental considerations
NE's detection environment includes specific factors that influence this rule's operation:
Device diversity: 768 P2 corporate workstations with full Defender for Endpoint telemetry, 58 P1 manufacturing workstations with basic cloud-delivered protection, and 3 RHEL rendering servers with Syslog-only coverage. Rules targeting DeviceProcessEvents operate with full fidelity on P2 devices but may have reduced visibility on P1 devices. Manufacturing workstations in Sheffield and Sunderland represent a detection gap for endpoint-level detections.
Your ATT&CK coverage analysis shows 45% coverage. The CISO asks: 'What is our target?' Do you say 100%?
No. 100% ATT&CK coverage is neither achievable nor meaningful — some techniques are inherently difficult to detect, some are irrelevant to NE's environment, and the cost of detecting the last 10% is disproportionate to the risk reduction. The target is based on NE's threat profile: 80% coverage of techniques observed in attacks against defense supply chain organizations (sourced from MDDR and CiSP intelligence). This threat-informed target focuses resources on the techniques NE is most likely to face, not on theoretical completeness.
You understand the detection gap and the hunt cycle.
TH0 showed you what detection rules fundamentally cannot catch. TH1 gave you the hypothesis-driven methodology that closes that gap. Now you run the hunts.
- 10 complete hunt campaigns — from hypothesis through KQL execution through finding disposition, each campaign based on a real TTP
- 70 production hunt queries — every one mapped to MITRE ATT&CK and tested against realistic telemetry
- Advanced KQL for hunting — UEBA composite risk scoring, retroactive IOC sweeps, and hunt management metrics
- Hypothesis-Driven Hunt Toolkit lab pack — 30 days of realistic M365 and endpoint telemetry with multiple attack patterns seeded in
- TH16 — Scaling hunts across a team — the operating model for a production hunt program