Free lab · no signup · about 5 minutes
Threat Hunt Plan Review
A bad hunt plan burns a week of analyst time and finds nothing, or finds something and nobody acts on it. Review six draft plans, flag what is wrong with each, and see how a good version would read.
Loading the plans…
What a good hunt plan has
- A testable hypothesis: one attacker behaviour you could prove or disprove with data.
- The right ATT&CK technique, so the finding feeds the right detections and coverage reports.
- Data sources that can see it: if the behaviour is a command line, firewall logs will not show it.
- A scope that fits the timebox: specific systems and a specific period.
- Exit criteria: what "done" means, including what you do with a clean result.
- An owner who books the time and writes it up.
Illustrative teaching scenario: the company, plans and people are fictional. MITRE ATT&CK technique IDs are real and taken from attack.mitre.org.
Questions
What is a threat hunt plan?
A short document written before a hunt starts. It states a testable hypothesis about attacker behaviour, maps it to a MITRE ATT&CK technique, lists the data sources that can show that behaviour, sets the scope and a timebox, defines when the hunt is finished, and names an owner.
What makes a hunt hypothesis testable?
It names a specific behaviour that leaves evidence in data you have, so a query can show it is happening or that it is not. "An attacker is password-spraying the VPN portal" is testable. "Something bad is happening on the network" is not.
Why does a hunt need exit criteria?
You can never prove an attacker is absent, so without a stop condition a hunt either never ends or ends when people get bored. Good exit criteria say what you will have reviewed and what you do with a clean result, such as turning it into a detection rule.
Why map a hunt to MITRE ATT&CK?
The mapping links the hunt to the detections, coverage reports and intelligence that use the same technique IDs. A wrong mapping sends the finding to the wrong place and makes coverage look better or worse than it is.
Is this free?
Yes. The plan review runs in your browser with no signup. The plans and people are fictional teaching scenarios; the ATT&CK technique IDs are real.
Keep going
- Hunt Desk: Every Hour Costs: pick which hunts to run when every analyst hour costs money.
- CTO Threat Brief Review: grade three threat intel briefs and decide what to do.
- SOC Log Triage Trainer: spot the attack hiding in a stream of logs.
- Cyber War Room: lead a full incident as the CISO (3 runs included with a free account).
- Threat management, in plain English: how intelligence, hunting, detection and response fit together.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.