In this section
TH1.14 Hunt Cadence and Scheduling Models
If it is not on the calendar, it does not happen
Hunting competes with alert triage for the same analyst hours. Alert triage always wins the competition because alerts are immediate and visible — an unresolved alert feels like a failure. An unexecuted hunt is invisible — nobody notices it did not happen.
The only defense is a calendar block that is treated with the same seriousness as an on-call shift. The analyst doing the hunting is not available for alert triage during those hours. If an alert fires, someone else handles it. If the team is too short-staffed to spare anyone, the hunting session is rescheduled to a specific date within the same week — not "we will do it when things calm down." Things do not calm down.
Three cadence models
// How much alert volume does your team handle?
// This informs whether you can protect hunting hours
SecurityAlert
| where TimeGenerated > ago(30d)
| summarize
DailyAlerts = count() / 30.0,
HighSeverity = countif(AlertSeverity == "High") / 30.0,
MediumSeverity = countif(AlertSeverity == "Medium") / 30.0
// If DailyAlerts > 50 with a 3-person team, protecting 4 hours
// weekly is difficult — consider biweekly or monthly cadence
// If DailyAlerts < 20, weekly cadence is easily achievableTry it yourself
Exercise: Select and implement your cadence
Run the alert volume query above. Based on your team size and daily alert volume, select a cadence model.
Block the first hunting session on your calendar — a specific date, a specific 4-hour block, with a specific analyst assigned. Share the calendar block with your SOC lead. If someone tries to reassign the analyst during the hunting block, the calendar entry is the evidence that hunting was scheduled and should not be interrupted without explicit rescheduling.
If the first session gets interrupted, reschedule it within the same week. If it gets interrupted three times, the issue is not hunting — it is alert workload. Address the workload (better tuning, automation, or headcount) before re-establishing the hunting cadence.
Cadence aligned to threat intelligence
Hunt scheduling should be driven by threat intelligence, not arbitrary calendars. When threat intelligence reports a new technique targeting your sector, schedule a hunt for that technique within the next cycle — do not wait for the next quarterly hunt calendar slot. NE's hybrid cadence: weekly micro-hunts (2-4 hours, single hypothesis, single data source), monthly focused hunts (full day, multi-table correlation, ATT&CK technique-aligned), and ad-hoc intelligence-driven hunts (triggered by threat reports, vendor advisories, or peer organization breach notifications). The weekly cadence maintains hunting muscle memory. The monthly cadence provides depth. The ad-hoc cadence provides agility.
The queries developed during this exercise become reusable templates in your personal hunting library. Parameterise the hardcoded values (user names, IP addresses, time windows) and add a header comment explaining the hypothesis each query tests. A mature hunting program maintains 50-100 parameterised query templates that any team member can execute — reducing the per-hunt preparation time from hours to minutes and ensuring consistent methodology across analysts.
Document the cadence in the SOC charter and the hunting program plan — both stakeholders and analysts need a single reference for scheduling expectations. The cadence must be communicated to leadership in terms they value: weekly micro-hunts prevent detection gaps between monthly hunt cycles, monthly hunts provide the depth to discover sophisticated threats that weekly time constraints cannot accommodate, and ad-hoc hunts demonstrate responsiveness to emerging threats — a capability that audit and compliance teams increasingly require evidence of.
The myth: Organizations should hunt every day. Daily hunting is the target that demonstrates mature threat operations.
The reality: Daily hunting is only viable with dedicated hunting teams that do not share alert triage responsibility. For the vast majority of organizations, daily hunting is neither achievable nor necessary. A monthly cadence that produces 12 documented campaigns, 12+ detection rules, and measurable coverage improvement per year is a high-performing hunting program. The metric that matters is not how often you hunt — it is whether hunts are completed, documented, and producing detection rules. A team that hunts monthly and completes every campaign outperforms a team that attempts daily hunting but cancels 80% of sessions due to alert pressure.
Extend this model
TH14 (the Phase 3 operations module) covers cadence management in organizational context — integrating hunting with sprint cycles, aligning hunt campaigns with threat intelligence briefing schedules, and building hunting into SOC team performance metrics. This subsection provides the practical starting point. The operations module provides the scaling framework.
References Used in This Subsection
- Course cross-references: TH0.7 (minimum viable program metrics), TH0.8 (prerequisite 5: protected time), TH0.14 (program metrics), TH14 (Phase 3 operations)
Detection depth: NE-specific implementation
This detection rule addresses a technique that directly threatens NE's operational environment. The implementation accounts for NE's specific infrastructure characteristics:
Telemetry source: The primary data table for this detection ingests approximately 0.5-3.2 GB/day depending on the activity volume. At NE's scale (810 users, 865 devices, 42 servers), the event volume generates a stable baseline that statistical detection methods (percentile analysis from DE9.4) can reliably characterize. Deviations from this baseline represent either environmental changes (new applications, infrastructure modifications) or attacker activity.
You have time for one hunt this quarter. Do you hunt for the threat in the latest advisory or for the gap in your ATT&CK coverage matrix?
Hunt the coverage gap. Advisories describe threats that are CURRENT but may not target NE. Coverage gaps describe techniques that COULD target NE and would succeed undetected. The coverage gap hunt produces a detection rule (closing the gap permanently). The advisory-driven hunt produces a point-in-time assessment (confirming the specific threat is not present today). Both are valuable — but the coverage gap hunt has a longer-lasting impact because it produces a permanent detection improvement.
You understand the detection gap and the hunt cycle.
TH0 showed you what detection rules fundamentally cannot catch. TH1 gave you the hypothesis-driven methodology that closes that gap. Now you run the hunts.
- 10 complete hunt campaigns — from hypothesis through KQL execution through finding disposition, each campaign based on a real TTP
- 70 production hunt queries — every one mapped to MITRE ATT&CK and tested against realistic telemetry
- Advanced KQL for hunting — UEBA composite risk scoring, retroactive IOC sweeps, and hunt management metrics
- Hypothesis-Driven Hunt Toolkit lab pack — 30 days of realistic M365 and endpoint telemetry with multiple attack patterns seeded in
- TH16 — Scaling hunts across a team — the operating model for a production hunt program