In one paragraph
This glossary defines the terms used across the guide. Definitions are short and practical; where a term comes from a published framework, the framework is linked. Terms are listed alphabetically, and each has its own anchor so other pages can link to it.
Guide updated September 2026 · Autonomous Threat Hunting editors
A
- Agent
- Software that takes a goal, chooses steps and tools, and acts across systems to reach it, checking its own progress. In hunting, agents plan and run queries and summarize findings.
- Agentic threat hunting
- Threat hunting in which software agents plan and run the steps of a hunt, such as choosing queries, reading results and deciding what to check next, rather than only suggesting them to an analyst. In this guide it covers Levels 2 to 4 of the autonomy model.
- Approval gate
- A point in an automated workflow where the system stops until a named person approves or rejects the next step. Common gates sit before a detection is deployed and before a response action runs.
- ATT&CK coverage map
- A view showing which MITRE ATT&CK techniques a set of detections or hunts is mapped to. A mapping records what the logic is meant to address, not proof that it would find the technique in your data; check which ATT&CK version the map uses. Source
- Autonomy level
- In this guide, one of five levels (0 to 4) describing how much a hunting system does without being asked. An editorial model, not an industry standard.
B
- Backtesting
- Running a new detection rule against historical data before release to estimate how often it would fire and whether it would have caught known activity.
C
- Continuous hunting
- Hunting that runs on a schedule or on the arrival of new intelligence, without a person requesting each hunt. Level 3 in this guide's autonomy model.
- Corroboration
- Checking a hunt hit against other data sources to see whether they support or contradict it, before presenting it to a person.
D
- Data lake
- A store for large volumes of raw data, often in cloud object storage or a warehouse, that security teams query alongside a SIEM for some data.
- Detection drift
- The gradual loss of a detection's effect when the data sources, schemas or field names beneath it change. Rules promoted from hunts need retesting whenever their sources change.
- Detection promotion
- Turning the logic of a successful hunt into a standing detection rule, usually after a backtest and a review.
- Detection rule
- Logic that runs continuously on incoming data and raises an alert when a defined pattern appears.
- Detection-as-code
- Managing detection rules as code in version control, with review, testing and automated deployment, instead of editing them by hand in a console.
- Directed hunt
- A hunt that starts from a hypothesis a person supplies, after which the system plans and runs the queries. Level 2 in this guide's autonomy model.
- Dry run
- A mode in which an automated hunt shows the queries it would run and their expected scope without executing them or changing anything. Useful for checking scope and cost before a hunt runs for real.
E
- EDR
- Endpoint detection and response: software on laptops and servers that records activity and can contain a host.
F
- False positive
- A result that looks malicious but turns out to be benign. In autonomous hunting it applies both to findings handed to a reviewer and to detections promoted from hunts.
- Federated search
- Running one logical query across several data platforms where the data already lives, instead of copying the data into one store first.
H
- Human in the loop
- A design in which a person must review or approve defined steps, such as confirming a finding or approving an action, before the system proceeds.
- Hunt library
- The collection of hunts a system can run on a schedule or on demand, usually grown from intelligence and past findings. Each entry needs an owner and a review date.
- Hunt report
- The record an autonomous system produces for one hunt: the hypothesis, the data sources and time range, the exact queries, the findings with their corroboration, what was not checked and the proposed next step.
- Hypothesis
- A testable statement about attacker behavior that a hunt sets out to confirm or rule out, naming the data needed to test it.
I
- Indicator of compromise (IOC)
- A specific artifact of malicious activity, such as a file hash, domain or IP address. Useful but short-lived compared with behaviors.
L
- Least privilege
- Giving an identity only the access it needs for its task. For a hunting agent, this usually means read-only access limited to the data sources its agreed hunts require.
M
- MCP
- Model Context Protocol, an open protocol that lets AI applications connect to external tools and data sources. Some hunting products state MCP support.
- MITRE ATT&CK
- A public knowledge base of adversary tactics and techniques maintained by MITRE. Enterprise v19.2 lists 15 tactics. Source
O
- OCSF
- Open Cybersecurity Schema Framework, an open schema for normalizing security event data so events from different sources share field names and structure.
P
- Playbook
- A written sequence of steps for a recurring task, such as hunting for one behavior or responding to one kind of incident. Automated systems may run playbooks as reusable templates.
Q
- Query budget
- A limit on how many queries, how much data scanned or how much compute an automated system may use on a data platform in a period, with a defined behavior when the limit is reached.
R
- Retrohunt
- Searching historical data for activity that matches new intelligence or a new rule, to find past intrusions or test a rule before deployment.
S
- Service identity
- A dedicated non-human account or credential that a system uses to reach a platform, so its activity can be logged, limited and revoked separately from people's accounts.
- SIEM
- Security information and event management: a platform that collects, stores and searches security logs. In this guide, SIEMs appear as data platforms that hunting systems read from.
- Sigma
- A generic and open signature format for detection rules, with more than 3000 community rules and tools that convert rules into platform query languages. Source
- Staged action
- A response step, such as isolating a host or revoking a session, that a system prepares but does not run until a person approves it.
- STIX/TAXII
- Standards for describing threat intelligence (STIX) and exchanging it between systems (TAXII).
T
- Tactic (ATT&CK)
- In MITRE ATT&CK, the adversary's goal at a stage of an intrusion, such as Initial Access or Credential Access. Enterprise v19.2 lists 15 tactics, each with an ID such as TA0006. Source
- Technique (ATT&CK)
- In MITRE ATT&CK, how an adversary achieves a tactic's goal. ATT&CK v19 lists 222 Enterprise techniques, and hunts and detections are usually mapped at this level. Source
- Threat hunting
- Proactively searching for attacker activity that existing detections have not flagged, starting from a hypothesis.
- Threat intelligence
- Information about adversaries, their behavior and their tools, from advisories, feeds and investigations, used to decide what to look for.
- TTP
- Tactics, techniques and procedures: how an adversary operates. Hunting on TTPs lasts longer than hunting on indicators alone.