Hunting Maturity
What is it?
Hunting maturity describes how a program's hunting capability grows: from having no telemetry at all, to collecting it, to running IOC-based hunts, to hypothesis-driven behavioral hunts, to automating proven hunts into detections. Higher maturity means finding subtler adversaries, faster.
Why it matters
Maturity tells a program honestly what it can and cannot hunt today — you cannot behavior-hunt without the telemetry that behavior lives in.
Where you see it
A program's self-assessment: what data do we collect, and what kinds of hunt can it support?
What normal looks like
A program that hunts at the level its telemetry supports, and invests in visibility before attempting hunts it cannot yet run.
What suspicious looks like
Not applicable directly.
How analysts investigate
By matching each planned hunt to available telemetry: a PowerShell behavior hunt needs command-line logging; without it, that hunt is a maturity gap, not a hunt.
Common beginner mistakes
- Attempting advanced behavioral hunts without the telemetry to support them, then concluding 'nothing found' when the real answer is 'nothing visible'.
Qasr wants to hunt PowerShell abuse — but discovers command-line arguments were never being logged. The correct output of that hunt is not 'clean'; it is 'blind — fix the telemetry first'. Maturity is knowing the difference.
Quick check
A PowerShell hunt returns zero results, and command-line logging was disabled the whole time. What is the honest conclusion?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.