> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/more-features/expel-threat-hunting/expel-hunting.md).

# About Expel Threat Hunting

Expel Threat Hunting extends your security team's visibility by analyzing alert and raw signal data from your security and IT stack. A dedicated team of threat hunters proactively reviews months of historical data in your environment, searching for threats specific to your organization. This work draws on Expel's visibility across its customer base and external threat intelligence, allowing hunters to identify undiscovered exploits, surface risks, and recommend steps to improve your security posture.

{% hint style="info" %}
Go to [**Activity > Hunting**](https://workbench.expel.io/activity/hunting/) to view the **Hunt Catalog** and see which techniques are supported with different technologies.
{% endhint %}

## What Is Threat Hunting?

Threat hunting starts from the assumption that you're already compromised. It's the counterpart to MDR: instead of starting from an alert, hunters start from a hypothesis and pursue it across months of historical data. Automation identifies key events matching that hypothesis as investigative leads, and threat hunters then search those leads for undiscovered exploits and risk in your environment.

New hunting techniques are developed using recent exploit data and threat intelligence, and are mapped to the MITRE ATT\&CK Framework.

## What's Our Process?

**Step 1:** Threat Operations engineers develop new hunting techniques based on research, recent attacker behaviors observed across the Expel customer base, and threat intelligence sources.

**Step 2:** Each month, threat hunters recommend hunting techniques from Expel's technique catalog, selected based on the surfaces your organization has subscribed to.

**Step 3:** You can accept the recommended technique(s) or select a different one.

**Step 4:** Threat hunters run the hunt using data collected from your environment (raw logs and alerts), enriched with supporting sources and compared against historical activity in your environment and across Expel's customer base.

**Step 5:** Threat hunters document the findings and make them available in [Activity > Hunting > Hunts](https://workbench.expel.io/activity/hunting/investigations). Any events they identify as malicious, suspicious, or notable are documented with a summary, supporting evidence, and recommendations for your review.

### **Categories of Findings**

**Malicious:** Events indicating attacker behavior or indicate serious risk. These are escalated immediately to the SOC queue as a High Expel alert. Threat hunters and SOC analysts collaborate on next steps to remediate.

**Suspicious**: Events that can't be confirmed as malicious but require input from your team to determine intent. Even if ultimately benign, these events may present risk and need customer validation to confirm the activity was expected.

**Notable**: Events that are likely benign but worth flagging and may present limited risk.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/more-features/expel-threat-hunting/expel-hunting.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.