SOC › Module 2 › Lesson 3
Hunt Loop
Hunt loop literacy names the iterative cycle — hypothesize, hunt, analyze, learn, tune — practiced on YOUR $HUNT_LAB hunt notes.
Visual · t30_hunt_loop
Hunt loop literacy. $HUNT_LAB only. Original Cyberlium.
Opening
One hunt rarely ends the story — literacy names the loop that turns findings into better detection on authorized data.
The hunt loop repeats: form hypothesis, query telemetry, analyze results, learn (confirm/refute/refine), tune detections or spawn new hypotheses. Mature teams measure loop velocity, coverage, and detection gaps closed per quarter — all on governed data. Cyberlium maps the hunt loop on YOUR $HUNT_LAB — one iteration documented on paper with fictional findings. Next: Hunting Lab.
1. Hunt loop stages (named)
Hypothesize: write testable statement. Hunt: run scoped query on lab jsonl. Analyze: interpret counts, timelines, outliers. Learn: document outcome. Tune: propose detection improvement or next hypothesis — lab paperwork only.
On $HUNT_LAB, diagram one full loop iteration for auth-failure hunt on sample data.
Command guide
Try these commands — Hunt loop stages (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Hunt loop — https://attack.mitre.org/ (iterative hypothesis refinement) NIST detection — https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final FIRST — https://www.first.org/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
export HUNT_LAB=${HUNT_LAB:-$HOME/cyberlium-lab/t30-hunt}
python3 - <<'PY'
loop = ['Trigger: new intel or detection gap', 'Hypothesis: write hunt-hypothesis.md', 'Query: jq/python3 on YOUR logs', 'Findings: true positive / benign / inconclusive', 'Feedback: tune rule or new hypothesis']
print('Hunt loop (YOUR lab):')
for s in loop: print(f' → {s}')
PYCommand — copy this
grep -E 'Hypothesis|Query|Refusals' "$HUNT_LAB/hunt/hunt-hypothesis.md"
Primary tools to practice this lesson: grep, python3. Reference sites: Hunt loop (https://attack.mitre.org/); NIST detection (https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final); FIRST (https://www.first.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why the loop beats one-shot searches
Single queries miss context — loops connect findings to detection engineering and future hunts. L2 who documents loop outcomes helps L3 and rule owners prioritize gaps.
Students trace loop on lab notes — not unauthorized production iteration.
3. Lab boundary
Forbidden: endless production querying without documentation or change control. Allowed: hunt loop card — five stages with $HUNT_LAB iteration example.
Ship: hunt loop card for YOUR lab iteration. Next: Hunting Lab.
4. What you ship: hunt loop card for $HUNT_LAB
One full loop iteration documented on lab scenario. $HUNT_LAB named. chmod 600.
5. What you record before the next lesson
Date. Hunt loop card. $HUNT_LAB named. File t30-m02-l03-hunt-loop.txt chmod 600.
6. Wrong vs right: stranger prod vs YOUR hunt telemetry
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run production queries with no learn/tune step. Skip documentation because hunt 'found nothing.'
Right
Write hunt loop card for YOUR $HUNT_LAB iteration. Next: Hunting Lab.
Mission: trace one hunt loop on YOUR lab data
1) Start from hypothesis in M2. 2) Note hunt query intent (jq on lab jsonl). 3) Write learn outcome and one tune idea. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Tune can mean new Sigma idea on paper — not silent prod rule deploy.
Knowledge Check
APPLY: Hunt loop stages include:
Multiple choice
Knowledge Check
APPLY: True or False: Documenting refuted hypotheses closes detection gaps over time.
True or False
Knowledge Check
APPLY: Hunt loop literacy on Cyberlium avoids:
Multiple choice