Notifications
Clear all
Elastic Endpoint Reviews
1
Posts
1
Users
0
Reactions
3
Views
Topic starter
19/07/2026 6:45 am
I'm finally dipping my toes into threat hunting after using Elastic Security for a while, but I'm feeling a bit lost. I've got all this data flowing in, but I'm not sure where to start looking. The typical "look for anomalies" advice is too vague.
Are there any good, practical guides from Elastic or the community that outline a first hunt? I'm looking for something that gives me a concrete starting point—maybe a specific query to run in Discover or a simple hypothesis to test against my own endpoint data. What worked for you when you were starting out?