FourCore HUNT: Agentic vs manual threat hunting
In manual hunting, a hunter writes, runs and checks every query by hand. With FourCore HUNT, FourCore Analyst does that work inside the SIEM and EDR/XDR you already run, explains every match and checks every empty result. Your hunters make the calls.
Who does the work
- Manual hunting
- A hunter reads the report, writes a query for each tool, runs it and reviews each match.
- FourCore HUNT
- FourCore Analyst does that work in every connected tool, and your hunters review the verdict.
When each one fits.
Hunters bring judgment and context. Agents bring coverage and consistency. Most teams want both.
Hunt by hand when
- A hypothesis comes from knowledge of your business that no report contains.
- An active incident needs a person following leads as they appear.
- The data lives in a tool that is not connected to FourCore.
- You are building hunting skills on the team.
Use FourCore HUNT when
- Every new campaign that targets your industry, region or tracked actors needs a hunt.
- You run several SIEM and EDR/XDR tools with different query languages.
- You want empty results checked, so a blind spot is never reported as clean.
- Good hunts should keep running on a schedule, and new indicators should be searched over past data.
How they work together
FourCore HUNT takes the repeatable hunts and the follow-up queries on every match. Your hunters decide what a suspicious result means and what happens next.
Side by side.
How a hunt starts, runs and ends in each approach.
Starting point
- Manual hunting
- A hypothesis, report or alert a hunter picks up
- FourCore HUNT
- A new campaign, a report your team shares, a CVE or advisory, or a question typed in FourCore, Slack or Microsoft Teams
Queries
- Manual hunting
- Written by hand for each tool and query language
- FourCore HUNT
- Written once as a Sigma rule and translated for each tool, or a labeled native query when Sigma can't express it
Matches
- Manual hunting
- Reviewed one by one by the hunter
- FourCore HUNT
- Each traced to a cause: normal software, your own FourCore ATTACK tests, or unexplained
Empty results
- Manual hunting
- Depends on the hunter checking retention, logging and host coverage
- FourCore HUNT
- Checked for retention, logs, reporting hosts and with a control query; gaps reported as could not check
Result
- Manual hunting
- Notes or a ticket, in each hunter's own format
- FourCore HUNT
- A verdict of Incident, Suspicious, Benign or Inconclusive, with the searches behind it
Repeat hunts
- Manual hunting
- Run again by hand
- FourCore HUNT
- Saved as versioned packages, run on a schedule, and retrohunted over past data
Changes to your tools
- Manual hunting
- Up to the hunter
- FourCore HUNT
- Read-only; any action that would change something waits for approval
Judgment
- Manual hunting
- The hunter's, throughout
- FourCore HUNT
- Your hunters decide what happens next on every verdict
Questions
Does FourCore HUNT replace our threat hunters?
No. It writes the queries, checks the results and follows up on every match, and your hunters decide what happens next.
Does FourCore HUNT change anything in our environment?
No. Hunts only read your data, and any action that would change something waits for approval.
Which tools does it hunt in?
Splunk, Microsoft Sentinel, Google SecOps and Elastic, plus Microsoft Defender, CrowdStrike Falcon, SentinelOne, Cortex XDR, Sophos XDR, TrendAI Vision One and Qualys EDR.
What if a tool is missing the logs a hunt needs?
The verdict says "could not check" and names the logging change that would close the gap. HUNT doesn't report a blind spot as clean.
See HUNT on your own data.
You pick the threats and tools, we connect read-only, and we review the verdicts together. Success criteria are agreed before it starts.