Foundations Review — Your First Hunt Brief
What is it?
A review of Module 1 — hunting vs triage, the detection gap, threat-informed selection, maturity, IOC vs TTP — assembled into the shape of a real hunt brief.
Why it matters
A hunt without a written brief is a fishing trip; the brief is what makes a hunt reproducible and reviewable.
Where you see it
The first artifact of every professional hunt.
What normal looks like
A brief with a hypothesis, a data source, a maturity check and an IOC-or-TTP choice.
What suspicious looks like
Not applicable at review level.
How analysts investigate
By assembling the four decisions Module 1 taught into one coherent plan before touching any telemetry.
Common beginner mistakes
- Writing a hunt brief with no data source named — the most common way a hunt stalls on day one.
Assemble Qasr's first hunt brief from the intelligence: a Gulf-retail campaign using credential theft and scheduled-task persistence. Turn that into a plan.
Quick check
Which is the strongest hunt HYPOTHESIS for this brief?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.