What is the main difference between hypothesis-driven and data-driven Threat Hunting?

Question

Options

• AData-driven hunts always require more data to search through than hypothesis-driven hunts.
• BData-driven hunting tries to uncover activity within an existing data set, hypothesis-driven hunting
• CHypothesis-driven hunts are typically executed on newly ingested data sources, while data-driven
• DHypothesis-driven hunting tries to uncover activity within an existing data set, data-driven hunting

• B
  86% (19)
• C
  5% (1)
• D
  9% (2)

Explanation

Option B is correct because data-driven threat hunting is an exploratory, bottom-up approach that analyzes existing datasets to surface anomalies and suspicious patterns without a predefined theory, while hypothesis-driven hunting starts with a specific, informed theory (based on threat intel or TTPs like MITRE ATT&CK) and then searches the data for evidence to confirm or refute it.

Option A is wrong because the volume of data searched is not what distinguishes these two approaches - both can involve large or small datasets depending on the environment.

Option C is wrong because hypothesis-driven hunting is not tied to newly ingested data sources; it can be applied to any data, old or new, guided by the initial hypothesis.

Option D is wrong because it reverses the definitions - it incorrectly attributes the "uncover activity within an existing data set" characteristic to hypothesis-driven hunting, when that better describes the data-driven approach.

Memory tip: Think of the name literally - hypothesis-driven means you lead with an idea (a hypothesis), while data-driven means you lead with the data itself. One starts with a question, the other starts with exploration.

No community discussion yet for this question.