You asked and the Intel 471 engineering team delivered. As a HUNTER customer utilizing the Hunt Management Module (HMM), you can now “bring your own” (BYO) threat hunting content to the HUNTER threat hunting platform. This enhancement enables your threat hunting team to map your hunt queries and activities to our tried-and-tested methodology for managing hunts and measuring hunt performance metrics that matter to your organization.
BYO hunt content is an enhancement to the HUNTER HMM, an industry-leading centralized hunt management framework that enables consistent and repeatable hunt practices, whether you’re using hunt packages created by your internal teams or one from the HUNTER platform’s expanding library of hunt packages that our expert hunters create. With this latest Hunt Management Module enhancement, users of the HMM can add their own contextual threat intelligence, analyst notes, and research to their custom hunts in line with the HUNTER methodology. The HMM enables hunt leaders to assign, track, and manage hunts, store and manage hunt queries and findings, and measure key hunt performance metrics that demonstrate return on investment for hunt activity.
Threat hunting teams now can maximize their internally built hunt packages that focus on the approximate 10% of threats unique to their organization, industry, or a localized risk. This enhancement is a game-changing complement to the HUNTER hunt packages that address up to 90% or so of emerging and ongoing threats. HUNTER hunt packages created by our threat hunters have been verified by our experts to identify advanced behaviors, threats, and tactics, techniques and procedures (TTPs) that have bypassed reactive detection methods. Each package contains pre-validated queries that hunters can deploy within minutes on most major EDR, NDR, and SIEM platforms, helping them hunt down emerging threats and widely used malicious behaviors in their environment faster.
BYO hunt content allows customers with the HMM to keep all their hunt findings, evidence, and remediation in one place where they can leverage the module’s metrics and reporting for their hunt content and our hunt packages. Customers can align their BYO hunt content with the contextual intelligence and documentation we continually update in our HUNTER hunt packages, such as up-to-date threat intelligence and new TTPs, tactical runbooks, contextual information, and documentation our threat hunters provide to guide analysts throughout the hunt lifecycle. Just like our HUNTER packages, customers can also tag custom hunt packages with threat actors and map them to MITRE ATT&CK techniques.
All custom hunt content will be included in the HMM’s Hunt Module Dashboard, Reports, and Metrics, enabling teams to quickly view hunt performance metrics, such as activity, packages used, and threat actor and technique findings. Customers can create custom Hunt Templates, and then either add their content alongside HUNTER hunt packages or create net-new Hunt Templates based on their hunts. After creating a custom hunt package with their own hunt queries, customers can then add their context and content to their packages as outlined in the images further below.
Customers are presented the same hunt methodology the HUNTER hunt team uses to apply the following information:
Image 1: Add Custom Hunt Packages with the Hunt Module Template
Image 2: Add Hunt Queries to a Custom Hunt Package
Image 3: Add your own contextual information to Custom Hunt Packages
Image 4: Add your research notes to Custom Hunt Packages
This update to the Hunt Management Module is another in our ongoing support of customers that want to bring their own content to the HUNTER platform. Stay tuned for further developments in early 2025!
Initial access brokers sell information about or access to compromised computers. Here's how to threat hunt for a known attack behavior involving PowerShell that's used by a prolific initial access broker.
In July 2025 threat actors exploited zero-day vulnerabilities in on-premises Microsoft SharePoint servers in an incident known as ToolShell. In this case study, we conduct a threat hunt for ToolShell-related activity.
Guided Threat Hunts offers a library of Pivot Queries for hundreds of hunt packages that enable your threat hunters and analysts to overcome uncertainty and boost productivity. Guided Threat Hunts is a set of packages that assists users modify their result set to decide their next step and filter out noise from extraneous results.
Stay informed with our weekly executive update, sending you the latest news and timely data on the threats, risks, and regulations affecting your organization.