MENU
A threat hunting team wants to ensure hunts are repeatable, scalable, and less dependent on individual analyst intuition. What is the MOST important process improvement?
The correct answer is standardizing hunt documentation and hypotheses. Mature threat hunting programs move beyond ad-hoc, intuition-driven efforts.
Standardization enables:
Knowledge sharing
Consistent methodology
Repeatable hunts
Easier onboarding of new analysts
Option A and B support operations but do not improve hunting maturity. Option D is unrealistic and risky.
By documenting hypotheses, data sources, queries, findings, and outcomes, organizations institutionalize knowledge and continuously improve detection capabilities.
This is a defining characteristic of high-maturity threat hunting programs.
Therefore, option C is correct.