SOC administrators typically assign security analysts to routine threat hunting when they are not actively pursuing in-progress threats or attacks. Threat hunting targets are picked largely by monitoring cybersecurity attacks and events reported daily across business sectors and choosing a threat that is likely to affect your organization. Another use of threat hunting is to identify applications which may represent unacceptable levels of risk to the organization, or use undesirable permissions/capabilities on the device, even though the application may not be identified as malicious.

As the MES Research dataset focuses on mobile apps, threat hunting activities described here pertain to mobile app risks and threats. When external intelligence includes a mobile app threat that could apply to your organization, you can use the MES Research capability to cross-reference the intelligence with the Lookout corpus of intelligence.

The threat hunting workflow typically starts with the MES Research query page. You begin your search by submitting a valid LQL query statement that includes your externally-sourced intelligence (example: IOCs) and reviewing matching results. Subsequent threat hunting workflow steps are similar to the incident response workflow outlined in the previous section, but generally include: