What's changed: Created Professional Security Operations Engineer Chapter 3 (Domain 3 "Threat hunting": cross-environment queries/user behavior analysis/investigation with Logs Explorer-Log Analytics-BigQuery-Google SecOps/IOCs/IR collaboration/hypotheses; GTI IOC search in historical logs/SCC toxic combinations/entity risk score/retrohunt (Google SecOps rules engine-BigQuery-Cloud Logging)/proactive search).
3.1Threat hunting across environments
Understand developing queries across environment logs to find anomalous activity, analyzing user behavior for anomalies, investigating network/endpoints/services for IOCs with Google Cloud tools (Logs Explorer, Log Analytics, BigQuery, Google SecOps), collaborating with incident response, and developing hypotheses from behavior/threat intel/posture/incident data.
Threat hunting is proactive: rather than waiting for alerts, form hypotheses and actively seek threats. Query across logs, find anomalies, and surface hidden compromise.
3.1.1Cross-environment queries and tools
Hunting starts with cross-environment queries. Use Logs Explorer (interactive search) for Google Cloud logs, Log Analytics or BigQuery for SQL analysis of large logs, and Google SecOps (UDM search; large-scale/long-retention telemetry) for cross-cutting security search. Through user behavior analysis, find out-of-norm activity (late-night mass downloads, access from unusual regions), and investigate network/endpoints/services to identify IOCs (indicators of compromise—malicious IPs/domains/hashes) and attack patterns. Map "interactive search of Google Cloud logs = Logs Explorer," "large-scale/long-retention security search = Google SecOps," and "SQL analysis of large logs = BigQuery/Log Analytics."
3.1.2Hypothesis development and collaboration
Good hunting starts with a hypothesis: from past incident data, threat intelligence (GTI actor TTPs), posture (SCC config risk), and observed behavior, form a testable hypothesis—"if an attacker targets here, this trace should appear in these logs"—and validate it with queries. While proactively seeking threats, collaborate with the incident response team to identify active threats and drive containment. Map "data-driven testable hypothesis = the starting point of hunting."
Common: requirement → tool. E.g., "interactive search of Google Cloud logs" = Logs Explorer; "SQL analysis of large logs" = BigQuery/Log Analytics; "long-retention cross-cutting security search" = Google SecOps; "identify IOCs (malicious IP/domain/hash)" = log investigation + GTI; "starting point of proactive hunting" = data-driven hypothesis.
Watch the mix-ups: (1) Threat hunting (proactive, hypothesis-driven) vs alert response (reactive) differ—hunting doesn't wait for alerts. (2) Choose Logs Explorer (interactive) vs Google SecOps (large-scale/long-retention SIEM search) by use. (3) Aimless searching without a hypothesis is inefficient—form data-driven hypotheses.
3.1.3Section summary
- Tools = Logs Explorer (interactive)/Log Analytics-BigQuery (SQL)/Google SecOps (large-scale, long-retention)
- Find anomalies via user behavior analysis; identify IOCs in network/endpoints/services
- Start from testable hypotheses based on incident/threat intel/posture/behavior
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which best captures the essence of threat hunting?
Q2. To interactively search/filter Google Cloud logs for investigation, which is best?
Q3. To search across months of large security telemetry and hunt threats in long-retention logs, which is best?
Q4. To flexibly aggregate/analyze large logs with SQL and find anomalous patterns, which is best?
Q5. What is the best starting point for effective threat hunting?