When to Conduct Structured and Unstructured Threat Hunts

Learn to distinguish between structured hypothesis-driven threat hunts and unstructured data-led threat hunts in this 34-minute conference talk from the SANS DFIR Summit 2025. Explore when to apply each methodology based on different triggers such as intelligence reports or advanced persistent threat (APT) activity that can initiate structured hunts. Discover how unstructured hunts develop through data discovery processes and understand the distinct objectives each approach serves in threat hunting operations. Gain practical insights from industry experts Lee Archinal, Senior Threat Hunt Analyst at Intel 471, and Arun Warikoo, Head of Cyber Threat Intelligence at CIB Americas BNP Paribas, as they guide you through making strategic decisions about which hunting approach to deploy in various scenarios to effectively identify and mitigate threats in your environment.