Topic starter
02/08/2026 11:39 am
TL;DR: Threat hunting works by assuming compromise already happened and correlating identity, network, and endpoint telemetry to find what alerts missed, according to Panther. The practical shift is not more alerts but better hypotheses, stronger data coverage, and tighter feedback loops from investigation into detections.
Editorial analysis by NHI Mgmt Group, based on content published by Panther: “What Is Threat Hunting? Process, Tools, and Techniques”.
Key questions
Q: What fails when cloud threat hunting only uses alerts and not identity context?
A: Alert-only hunting misses the surrounding evidence that explains whether an identity event is normal, over-privileged, or adversary-driven.
Q: Why do service accounts and role assumptions matter so much in threat hunting?
A: Because they are the paths attackers use to turn stolen access into legitimate-looking activity.
Q: What signs suggest a cloud identity path is being abused during a hunt?
A: Look for role assumptions from unusual IP ranges, access into accounts a principal has never touched, and activity that does not match historical deployment timing.
Practitioner guidance
- Broaden identity telemetry beyond sign-in events Ingest IdP logs, CloudTrail, role trust data, and permission changes into the same investigation layer so identity activity can be correlated with cloud movement.
- Build hunts around role-assumption outliers Write hypotheses that look for cross-account AssumeRole activity, unusual source locations, and access paths that do not match normal deployment patterns.
- Baseline service account behaviour by workload Separate normal automation from suspicious use by documenting which principals should act, from where, and against which accounts or resources.
Bottom line: Cloud threat hunting depends on correlating identity activity with network, configuration, and endpoint evidence rather than treating alerts as the only source of truth.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:52 pm
Identity telemetry is now a hunting substrate, not just a control log. Cloud investigation fails when teams treat authentication and role-assumption data as compliance records instead of active threat evidence. The hunt only becomes meaningful when identity events are joined to network paths, trust policies, and baseline behaviour. Practitioners should therefore design hunting coverage around identity evidence that can be correlated, not merely retained.
A question worth separating out:
A: Prioritise identity hunting when cloud access paths are poorly understood, role trust is broad, or the team lacks confidence that current detections cover cross-account abuse. Hunting helps identify what rules are missing, while detections handle known patterns at scale. The right sequence is to use hunts to expose blind spots, then encode the findings into detections.
👉 Read our full editorial: Threat hunting in cloud environments needs richer identity data