Cybersecurity threat hunting quick reference

Fast lookup for triage, host, identity, cloud, query, and network investigations. Use the left navigation or search; pages favor compact tables, suspicious patterns, next pivots, and small copyable blocks.

Host
Universal triage, Windows events, Sysmon, memory, PowerShell, persistence, Linux, and macOS.

Identity
Authentication triage, Active Directory, and common identity attacks.

Cloud
Cloud triage, AWS, Azure, and cross-platform service mapping.

Query Languages
Splunk SPL and Microsoft KQL concept and syntax cross-reference.

Network
Network triage, correlation, DNS, HTTP, TLS, packets, and flows.

Universal triage flow

Trigger → Validate → Context → Timeline → Scope → Cross-telemetry pivots → Intent and impact

Use

Treat individual signals as leads, not verdicts. Confirm time range, telemetry coverage, expected administration, and production impact.