Overview
Queries are how a hunter interrogates telemetry to test a hypothesis — the searches and filters that turn a question about attacker behavior into concrete results from the data.
Learning objectives
- Explain the role of queries in threat hunting.
- Describe how a hypothesis is translated into effective queries.
- Identify practices that make hunting queries reliable.
Core concept
A query is a structured search against telemetry (often via the SIEM's query language, module 5, or an EDR search) that retrieves the events relevant to a hypothesis. Queries are the hunter's primary tool for testing a hypothesis: having identified the telemetry and a baseline, the hunter writes queries to find the specific behavior or the deviations from normal. Effective queries balance precision (narrow enough to surface the meaningful events, not everything) and completeness (broad enough not to miss the behavior). They typically filter by the right fields (module 5 — timestamps, hosts, accounts, event types), compare against baseline patterns, and aggregate or pivot to reveal relationships (e.g. grouping task-creation events by account and time). Querying is iterative: initial results refine the query, which reveals more, in a loop until the hypothesis is confirmed or refuted. Well-constructed queries are also the seed of new detection rules.
How it works
The hunter translates the hypothesis into queries. For "scheduled tasks created outside change windows," a query filters the endpoint telemetry to task-creation events, restricts to the target servers, and surfaces those with timestamps outside defined change windows and by unusual accounts — using the fields and parsing from module 5 and the baseline from the previous lesson. Results are examined and the query refined: too many results → tighten filters (exclude known-good accounts/windows); too few or suspicious gaps → broaden or check telemetry coverage. The hunter often pivots — from a suspicious task to the process that created it, then to that process's parent (EDR process tree, module 12), then to network connections around that time — following the thread across telemetry. Good practice includes documenting queries (so hunts are repeatable), being mindful of query performance over large data, and validating that a query actually captures what it intends (an empty result from a mistyped field is not the same as "no threat"). Queries that reliably surface malicious behavior can be promoted into automated SIEM detections, improving future coverage.
Practical example
The hunter writes a SIEM query: filter endpoint logs to event = scheduled_task_created, host in (target servers), exclude the known admin accounts and change-window hours from the baseline. The query returns the anomalous 3 a.m. task from an unusual account. The hunter then pivots: a follow-up query finds the process that created the task, and the EDR process tree shows its suspicious parent; another query pulls that host's network connections around 3 a.m., revealing a connection to an unfamiliar external address. Each query builds on the last, tracing the behavior across telemetry. The hunter documents these queries so the hunt is repeatable and so the effective one can become a standing detection. The chain of queries has now turned a hypothesis into concrete, investigable evidence — ready for validation.
Cybersecurity relevance
Queries are the mechanism that makes hunting actionable — the bridge from a hypothesis to evidence in the data. Skillful querying (precise filtering on the right fields, comparison to baseline, and pivoting across telemetry) lets a hunter efficiently confirm or refute a hypothesis and trace an attacker's activity end to end. Because hunting queries that reliably catch malicious behavior can be promoted into automated SIEM detections, querying also directly strengthens the SOC's future automated coverage. It draws together SIEM query skills, field parsing, baselines, and process/network telemetry from across the path.
Common mistakes
- Queries too broad (drowning in results) or too narrow (missing the behavior) — failing to balance precision and completeness.
- Trusting an empty result without checking the query is correct (a mistyped field can hide a real threat).
- Not documenting queries or pivoting, so hunts aren't repeatable and threads of activity go unexplored.
Key takeaways
- Queries interrogate telemetry to test a hypothesis, filtering on the right fields and comparing against baseline.
- Effective hunting queries balance precision and completeness and are refined iteratively, with pivoting to trace activity across telemetry.
- Document queries for repeatability, verify they capture what's intended, and promote reliable ones into automated detections.
Check your understanding
- How does a hunter translate a hypothesis into effective queries, and why is pivoting important?
- Why is an empty query result not automatically proof that no threat exists?