About Expel Threat Hunting

Expel Threat Hunting extends your security team's visibility by analyzing alert and raw signal data from your security and IT stack. A dedicated team of threat hunters proactively reviews months of historical data in your environment, searching for threats specific to your organization. This work draws on Expel's visibility across its customer base and external threat intelligence, allowing hunters to identify undiscovered exploits, surface risks, and recommend steps to improve your security posture.

Go to Activity > Hunting to view the Hunt Catalog and see which techniques are supported with different technologies.

What Is Threat Hunting?

Threat hunting starts from the assumption that you're already compromised. It's the counterpart to MDR: instead of starting from an alert, hunters start from a hypothesis and pursue it across months of historical data. Automation identifies key events matching that hypothesis as investigative leads, and threat hunters then search those leads for undiscovered exploits and risk in your environment.

New hunting techniques are developed using recent exploit data and threat intelligence, and are mapped to the MITRE ATT&CK Framework.

What's Our Process?

Step 1: Threat Operations engineers develop new hunting techniques based on research, recent attacker behaviors observed across the Expel customer base, and threat intelligence sources.

Step 2: Each month, threat hunters recommend hunting techniques from Expel's technique catalog, selected based on the surfaces your organization has subscribed to.

Step 3: You can accept the recommended technique(s) or select a different one.

Step 4: Threat hunters run the hunt using data collected from your environment (raw logs and alerts), enriched with supporting sources and compared against historical activity in your environment and across Expel's customer base.

Step 5: Threat hunters document the findings and make them available in Activity > Hunting > Hunts. Any events they identify as malicious, suspicious, or notable are documented with a summary, supporting evidence, and recommendations for your review.

Categories of Findings

Malicious: Events indicating attacker behavior or indicate serious risk. These are escalated immediately to the SOC queue as a High Expel alert. Threat hunters and SOC analysts collaborate on next steps to remediate.

Suspicious: Events that can't be confirmed as malicious but require input from your team to determine intent. Even if ultimately benign, these events may present risk and need customer validation to confirm the activity was expected.

Notable: Events that are likely benign but worth flagging and may present limited risk.