Emerging threats
New campaigns filtered by your industry, region and the threat actors you track, each hunted once and kept on watch.
Agentic Threat Hunting · FourCore HUNT: Hunt every new threat in the tools you already run.
Agentic threat hunting uses AI agents to turn threat intelligence into searches, run them in your SIEM and EDR, follow up every match, and report a verdict with its evidence.
FourCore Analystjust now
“Are we affected by the campaign in this morning's advisory?”
Not seen.
Its behaviors and indicators searched in two SIEMs and the EDR. Nothing matched, and each tool had the logs to see it.
- Splunklogs confirmed
- CrowdStrike30 days kept
What is agentic threat hunting?
Agentic threat hunting is threat hunting carried out by AI agents. They take a threat report or a question, write the searches for each of your tools, run them where your data lives, investigate what comes back, and report what was found and what couldn't be checked. Your hunters review the results and decide what happens next.
Hunt
One question, searched in every tool
A new campaign, an advisory, a report your team shares or a plain question becomes behaviors and indicators to look for. Each one is written once and translated into the query language of each SIEM and EDR you run.
What is AI threat huntingYou ask
Did an Office app start a script host this month?
Running in Splunk
index=edr parent_process_name IN
(winword.exe, excel.exe)
process_name IN (wscript.exe, mshta.exe)Also running inMicrosoft SentinelCrowdStrikeCortex XDR
Investigate
Every match followed to its cause
Matches are traced to normal software, admin activity, your own attack simulations, or nothing known. Follow-up searches run until each match is placed, so the team only sees the hosts that need a person.
Investigated
372 matches, 2 hosts left to review.
- Admin tools
- 318
- Software updates
- 52
- For your review
- 2
Check
An empty result is checked before it counts
No matches can mean nothing happened, or that the search couldn't see. The logs, fields and retention behind each search are checked, and a tool that can't answer is reported as a gap, not as clean.
Explore FourCore HUNTCoverage
- SplunkNot seen
Process logs and fields confirmed
- CrowdStrikeNot seen
30 days of telemetry kept
- Microsoft SentinelCould not check
No process logs from 12 servers
How an agentic hunt works.
The same loop runs for every new threat that matters to you. FourCore Analyst AI agents do the work, and your team makes the calls.
FourCore Analyst
Hunts and investigates
Your team
Reviews and decides
New threat
A report or advisory becomes a hunt.
5 behaviorsHunt
Searches run in every tool, read-only.
372 matchesInvestigate
Every match followed to its cause.
2 hosts to reviewDecide
Your team looks at the hosts that need a person.
Both reviewedImprove
A rule tuned on past data, a logging gap named.
1 rule, 1 gapWatch
The hunt keeps running on a schedule.
Daily watch
Agents
You
New threat
A report or advisory becomes a hunt.
5 behaviorsHunt
Searches run in every tool, read-only.
372 matchesInvestigate
Every match followed to its cause.
2 hosts to reviewDecide
Your team looks at the hosts that need a person.
Both reviewedImprove
A rule tuned on past data, a logging gap named.
1 rule, 1 gapWatch
The hunt keeps running on a schedule.
Daily watch
What agentic hunting covers.
Start from whatever your team has in hand: a report, a list of indicators, a rule or a question.
Indicator sweeps
IPs, domains and hashes from a report, cleaned of defanging and searched across every connected tool.
Behavior hunts
The techniques behind a threat, written as Sigma where possible and run in each tool's own query language.
Retrohunts
New indicators and rules run over the data your tools already keep, with how far back each tool could look.
Detection tuning
A rule change tested on the same data before and after, so you see what each change removes.
Questions in chat
A question typed in FourCore, Slack or Microsoft Teams becomes a hunt with a verdict.
Where teams use agentic threat hunting.
- Answering "are we affected?"
- When a new advisory lands, get a verdict with its searches and limits, instead of a guess.
- Hunting at the pace of new intel
- Hunt each relevant new threat, not only the few a busy team has time to pick up by hand.
- Detection engineering
- Turn good hunts into tuned rules and saved hunts that run again on a schedule.
- Finding logging gaps
- Every "could not check" names the missing logs and the change that would close the gap.
Detection rules, manual hunting and agentic hunting.
Each one answers a different question. Rules catch what you already know to look for, and hunting looks for what slipped past them. Agentic hunting does the searching and follow-up, so your hunters spend their time on the decisions.
| Method | What it does | How often | What you get |
|---|---|---|---|
| Detection rules | Alerts on known patterns as data arrives | Always on | Alerts to triage |
| Manual threat hunting | Hunters write and run searches by hand | As time allows | Findings in notes or a report |
| Agentic threat hunting | AI agents hunt, investigate and check coverage | Every relevant new threat, and on a schedule | A verdict with searches, evidence and limits |
Read threat intelligence vs threat hunting, or the short threat hunting definition.
Questions
What is agentic threat hunting?
Agentic threat hunting is threat hunting carried out by AI agents. They turn a threat report or a question into searches, run them in an organization's SIEM and EDR, investigate the matches, and report a verdict with the evidence behind it.
How is it different from detection rules?
Detection rules alert on known patterns as data arrives. Threat hunting looks for activity that rules missed, including new threats that no rule covers yet. Agentic hunting runs those hunts and their follow-up for each relevant new threat.
Does it replace threat hunters?
No. The agents write the searches, check the results and follow up on every match. Hunters review the hosts that need a person and decide what happens next.
Does it change anything in our environment?
With FourCore HUNT, no. Hunts only read your data, detection and prevention settings stay as they are, and any action that would change something waits for approval.
What if a tool is missing the logs a hunt needs?
The verdict says "could not check" for that tool and names the logging change that would close the gap. A blind spot is never reported as clean.
Which tools does FourCore HUNT hunt in?
Splunk, Microsoft Sentinel, Google SecOps and Elastic, plus Microsoft Defender, CrowdStrike Falcon, SentinelOne, Cortex XDR, Sophos XDR, TrendAI Vision One and Qualys EDR.
Start with one threat you need an answer on.
Bring a report or a question. We connect read-only to your tools and review the verdict, its searches and its limits with you.