Get Huntpedia

The Hunting Maturity Model, rst developed by Sqrrl's own security technologist and chief hunter, David J. Bianco, describes five levels of organizational hunting capability, ranging from HM0 (the least capable) to HM4 (the most).

The Hunting Maturity Model (HMM) is a simple model for evaluating an organization's threat hunting capability. It provides not only a "where are we now?" metric, but also a roadmap for program improvement.

Threat hunting shifts security operations from reactive to proactive by searching for signs of attacker tactics, techniques, and procedures (TTP) within an environment that have evaded or haven't yet been picked up by existing detection technologies.

Sqrrl is an industry-leading Threat Hunting Platform that unites proactive hunting workflows, link analysis, user and entity behavior analytics (UEBA), and multi-petabyte scalability capabilities into an integrated solution.

Cyber threat hunting is a proactive security search through networks, endpoints, and datasets to hunt malicious, suspicious, or risky activities that have evaded detection by existing tools.

The current Threat Hunting Maturity Model was created by Sqrrl in 2017 to assess the hunting capacity of an organization. In particular, the Sqrrl Threat Hunting Model was developed by David J. Bianco (@DavidJBianco), a Hunter and Security Architect.

The Hunting Maturity Model, developed by Sqrrl's security architect and hunter @DavidJBianco, describes five levels of organizational hunting capability, ranging from HMM0 (the least capable) to HMM4 (the most). Let's examine each level in detail.

Stacking is best used with data sets that produce a finite number of results.