Study. uk . com
  1. Home
  2. All questions
  3. Question 448

CompTIA Security+ study material · question 448 of 611

What distinguishes threat hunting from alert triage?

  1. Hunting starts from a hypothesis and searches existing telemetry rather than waiting for a rule to fire
  2. Hunting uses automated correlation rules
  3. Hunting is performed only after an incident
  4. Hunting requires an external intelligence feed
Show the answer

Answer: A. Hunting starts from a hypothesis and searches existing telemetry rather than waiting for a rule to fire

Hunting looks for what the existing rules would have missed, which is why it is proactive rather than reactive.

Challenge yourself on this topic → Study as cards