Hunt Program Outputs That Build the Program

// introduction

The Hunt Program That Consumes Time and Produces Nothing Durable

Threat hunting is resource-intensive, senior analyst time, tooling access, data processing costs. But most hunt programs have no systematic process for converting hunt activity into program assets. A hunt that finds an adversary produces an incident. A hunt that finds nothing produces a verbal debrief, a closed ticket, and institutional amnesia.

The compounding problem: a program without structured outputs cannot improve. Each hunt starts from approximately the same knowledge base as the last one, because nothing from prior hunts was captured in a reusable form. Hunt outputs are not a reporting requirement, they are the mechanism by which hunting improves detection coverage, reduces telemetry gaps, and builds the institutional knowledge that makes the next hunt faster and more precise.

// framework

The Four Output Types: a Routing Framework

Every completed hunt should produce exactly one of four structured outputs. The output type determines routing, documentation standard, and downstream program impact. A single hunt can produce multiple output types simultaneously.

// output type 2

Detection Candidates: the Highest Long-Term Value Output

A detection candidate is a hunt query that produced actionable signal, activity that, if observed again, should trigger an alert. It converts one analyst's investigation into a permanent automated capability. Not every hunt query meets the quality threshold:

• The signal must be specific enough to have an acceptable false positive rate in production
• The technique must not already be covered by an existing production rule
• The required telemetry must be reliably available, not dependent on an intermittent log source
• The detection logic must be expressible as a rule, not dependent on analyst judgment that cannot be codified

The known bypass field is non-negotiable. A detection candidate handed to engineering without documenting how it can be evaded produces a rule that gives false confidence. Every candidate should also be validated against the Atomic Red Team test for the covered technique before promotion to production.

// output type 3

Telemetry Gap Findings: a First-Class Output

A gap found during a hunt is a gap that exists right now, for a technique a threat actor in your sector is actively using. It is more operationally urgent than a gap discovered during an annual coverage review. Three gap types, each with different remediation paths:

• Missing log source: the event type is simply not collected, requires configuration change or sensor deployment
• Truncated or stripped fields: the log source is collected but critical fields are stripped at ingestion, requires pipeline configuration change
• Retention window mismatch: collected but retained for 14 days; the hunt requires 90-day visibility, requires a budget conversation

The threat relevance field converts a gap record from a technical finding into a prioritizable risk item. Naming specific threat actors that use the undetectable technique provides the business case for remediation investment.

// output type 4

Negative Findings and the Absence-of-Evidence Library

Negative findings are the most systematically neglected hunt output, and the one with the highest latent value for incident scoping. A negative finding is not "we found nothing." It is a documented assertion: we searched for a specific technique in specific telemetry across a specific scope for a specific time window and did not observe evidence of it, with a confidence level based on telemetry completeness.

Three confidence levels, applied consistently:

• High confidence: telemetry source confirmed complete for the hunt scope and time window. The technique was not observed. This assertion can be cited in IR scoping to bound where activity did not occur.
• Medium confidence: telemetry present but with known limitations. The technique was probably not observed but absence cannot be asserted definitively.
• Low confidence: telemetry gaps prevent a meaningful search. Record as a telemetry gap (Output Type 3), not a negative finding.

Negative findings accumulated over time become a queryable absence-of-evidence library. When an incident occurs, the IR team can query this library to determine which techniques have been searched for and not found in recent periods, reducing scope and focusing investigation. A growing library of high-confidence negative findings is also a defensible artifact in regulatory investigations and post-incident reviews.

// documentation

The Hunt Record: Making All Four Outputs Durable

Every completed hunt requires a hunt record: the parent document that captures the full analytical context and links to each output generated. It should be readable by an analyst who was not present and must reconstruct what happened.

The queries used field must be verbatim and reproducible, not a description, not pseudocode. Another analyst must be able to paste it into the SIEM and reproduce the hunt exactly. The data sources checked field is as important as the result, it defines the evidence boundary of the hunt's conclusions.

// metrics

Program Metrics That Only Become Possible with Structured Outputs

These metrics require structured output records to compute. They cannot be calculated from hunt tickets or verbal debriefs. The documentation discipline and the measurement capability are the same investment.

// conclusion

A Hunt Program Is Only as Mature as Its Outputs

The value of a hunt program is not measured by how many hunts ran or whether any found an adversary. It is measured by whether the program is detectably better after six months of hunting than it was before. Detection candidates in production, telemetry gaps closed, a growing absence-of-evidence library, these only exist if outputs are structured and routed.

The closing test: take your last ten hunt records and count how many produced a detection candidate that reached production, how many identified a telemetry gap that was subsequently closed, and how many generated a negative finding with a documented confidence level. If the answer to all three is zero, you have been running hunts. You have not been running a hunt program.