> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-reference/tools/threats/emerging-threat-hunts.md). # Emerging Threat Hunts When Expel determines a [Threat Bulletin](/workbench-reference/tools/threats/threat-bulletins.md) is necessary, there is often a need to do a historical scan of the requisite technology logs for any known indicators of compromise (IOCs) in a customer's environment to determine possible impact. In those situations, we will search the raw logs of supported technology for the IOCs we know about at the time, and determine if you appear to be impacted. If potential impact is detected, a hunt on that data will begin and Expel alerts may be generated and triaged by Expel SOC analysts to determine if any malicious activity did in fact take place. SOC analysts will then open investigations and incidents as necessary. Expel always recommends double-checking your environment for the IOCs we provide in these communications. ### When does Expel conduct or deliver an Emerging Threat Hunt? Emerging Threat Hunts are offered to Expel MDR customers who have purchased the Expel MDR Premium tier, or signed with equivalent entitlements. Expel makes a determination to deliver an Emerging Threat Hunt if the nature of the threat and its urgency warrants a historical IOC sweep of the customer base. For example, when we have high fidelity specifics on the IOCs tied to an attack and determine that existing vendor technology defenses may not catch or block the attack, and Expel detections would not have alerted for the attack. In some cases, an Emerging Threat Hunt would not apply, such as when there is an update to a vulnerability's exploitation maturity, but with no known cases of exploitation, and that require in-person exploitation. Limitations may also prevent an Emerging Threat Hunt from being conducted in your environment even in cases when Expel issues a Threat Bulletin. For instance, if a customer doesn't have the appropriate technology onboarded to Workbench at the time, if Expel doesn’t access to the logs, or if the customer is not subscribed to Expel MDR Premium tier. ### What can I expect from an Emerging Threat Hunt? Emerging Threat Hunts are the follow-on actions from a Threat Bulletin when the situation is a good fit for a threat scan to be conducted. In the **Threats** section in Workbench there would be a clear trail of activity done in your environment, including: * What we were looking for (the IOCs) and why * Where in your environment we were looking * The time range when we were looking (a two-week period is the default) * Whether we found evidence of threats in your environment, and any resulting alerts, investigations, or incidents ### Limitations of an Emerging Threat Hunt Expel Emerging Threat Hunts do have limiting factors, including: * A two-week default period of a historical lookback. * An Expel Threat Bulletin must be issued for us to conduct these — meaning we do not take customer requests for ad hoc threats — however, you can open an on-demand investigation in those situations. * Not all technology or attack surfaces may be supported or considered in scope for a viable Emerging Threat Hunt. * Customers will need to be subscribed to the appropriate MDR SKUs and tiers, as applicable. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/workbench-reference/tools/threats/emerging-threat-hunts.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.