Hypothesis-based threat hunting
Using synthetic logs, write a hunt hypothesis, describe evidence that would support or reject it, and draft a Splunk search. Record the results and propose a recurring detection.
The Cyber Threat Hunter documents testable hypotheses and develops tested Splunk detection logic from them.
Source posting