MDR Threat Hunts

This page outlines the proactive threat hunting capabilities included with MDR and explains how you can review completed hunts in the Command Platform.

Rapid7’s MDR Threat Hunting team is a dedicated group of experienced security analysts who proactively search for indicators of compromise (IOCs) and adversary tactics, techniques, and procedures (TTPs) across applicable customer environments. The team combines threat intelligence, analyst expertise, and available telemetry to look for activity that may warrant further investigation.

MDR Threat Hunting

Proactive threat hunting adds another layer of protection to Rapid7’s continuous monitoring and detection services. Monitoring typically begins with an alert. Threat hunting starts with a question: could this threat or attacker behavior be present in the environment even if no alert has fired?

To answer that question, Rapid7’s threat hunters search available historical telemetry for signs of emerging threats and known attacker techniques. They apply new threat intelligence across your applicable environments and review the results for activity that may require further investigation.

The findings from each hunt also help Rapid7 improve its understanding of attacker behavior and identify ways to strengthen future detection and investigation efforts.

How Hunts Are Initiated

Threat hunts are performed regularly for new or novel threats in your environment. A hunt may be prompted by new threat intelligence, emerging attacker activity, detection research, an incident response engagement, or relevant intelligence shared by you.

The MDR Threat Hunting team also uses intelligence from Rapid7’s Intelligence Hub, which combines Rapid7 Labs research with curated intelligence about threat actors, campaigns, IOCs, TTPs, and actively exploited vulnerabilities to help identify potential hunt opportunities.

Each opportunity is evaluated based on the threat, its potential relevance to you, and the telemetry required to investigate it. When appropriate, the hunt is conducted across your environments to which the threat and available data apply.

You are invited to share relevant threat intelligence, including security advisories, research, and reports, with your Cybersecurity Advisor. Rapid7 evaluates the submitted intelligence to determine whether it warrants a broader hunt. Requests that apply only to the you should be submitted through the customer portal.

Hunt Scope and Coverage

Each hunt focuses on a defined threat or attacker behavior and searches the available log, alert, or endpoint telemetry relevant to that activity. Hunts may evaluate specific IOCs, such as IP addresses, domains, URLs, or file hashes, as well as broader TTPs associated with the threat.

Threat hunting is distinct from vulnerability scanning. InsightVM provides Rapid7’s primary vulnerability scanning and management capabilities, while the MDR Threat Hunting team searches for evidence of compromise or attacker activity. Intelligence related to a vulnerability may still prompt a hunt for signs that the vulnerability has been exploited.

The coverage of an individual hunt depends on the data available from each environment. Missing, misconfigured, or unavailable event sources may prevent the team from evaluating some IOCs or TTPs. Log Search and Rapid7 SIEM (InsightIDR) provide up to 13 months of historical data for applicable log-based hunts. Endpoint-based hunting is currently limited to the endpoint telemetry available to the MDR Threat Hunting team.

Hunt Outcomes

A completed hunt includes several components: the intelligence that prompted the search, the data and time range covered, the queries and IOCs evaluated, and the outcome. Some hunts may conclude without actionable findings. This means the analysis did not identify activity that required escalation outside the scope of that hunt.

If a hunt identifies validated findings, a Rapid7 SIEM (InsightIDR) investigation is created and linked to the hunt. MDR SOC analysts review the investigation and determine the appropriate next steps. If a hunt identifies an active compromise in your in-scope environment, Rapid7 will initiate incident response.

Review Completed Hunts

Completed hunts are published to the Threat Hunts page in the Command Platform. From this page, you can review background on the threat actor or campaign, see how Rapid7 investigated the threat across your environment, and determine whether the hunt resulted in a linked investigation. You can also generate and download reports.

You may notice a gap between the hunt’s time range and the date it was published. The time range represents the period of data searched. After running the search, the MDR Threat Hunting team reviews and validates the results before publishing the hunt record.

Access the Threat Hunts Page

To access the Threat Hunts page, you must be an MDR customer with an active Command Platform account and be using the new Unified Platform Navigation. Customers using the legacy navigation cannot access the Threat Hunts page.

To open the page:

1. From the Command Platform, go to Response & Remediation > Threat Hunts.

Summary cards at the top of the page show the total number of hunts completed during the last 30 days and how many had validated findings. The list below provides the name, source, findings status, and publication date of each Closed hunt.

The Source field identifies what prompted the hunt, such as Threat Intelligence, Emergent Threat Response, or an Incident Response Engagement. The Findings field indicates whether the hunt resulted in a linked IDR investigation.

Use the filter bar to narrow the list by source, status, or other attributes. You can also use the search box to find a specific hunt by name or switch between grid and list views using the view toggle icons to the left of the Search box.

Explore hunt details

Select a hunt from the list to open its details. The Threat Hunt Details page combines the background, scope, and outcome of the hunt.

Header and metadata

The page header displays the hunt name, status badge (for example, Closed), and the following metadata:

Summary counters

Three counters appear directly below the header:

Overview tab

The Overview tab contains three sections:

Hunt Details

• Description - A plain-language explanation of what Rapid7 was looking for and why it is relevant to your environment.
• Threat Brief - The intelligence rationale behind the hunt, including where the threat intelligence originated and why this hunt was prioritized. This may appear as a summary paragraph or a link to an external source.

Investigations

If a hunt has validated findings, a SIEM (InsightIDR) investigation is created automatically and linked in this section. If this section reads No investigations linked to this Threat Hunt, the hunt completed without actionable findings in your environment.

Queries

The exact queries Rapid7 ran during the hunt are listed here, along with the log source each query targets. For example, LE_DNS or LE_WEB_PROXY. From this section, you can:

• Copy a query to your clipboard by selecting the copy icon next to the query.
• Open a query directly in Log Search by selecting Run in Log Search. See Re-run hunt queries in Log Search for details.

IOCs tab

Select the IOCs tab to view the specific indicators (IP addresses, domains, file hashes, or URLs) that Rapid7 searched for during the hunt. These are the raw data points used to conduct the hunt.

Re-run hunt queries in Log Search

Each query on the Threat Hunt Details page includes a Run in Log Search button. Selecting it opens Log Search with the query and the hunt’s original time range pre-populated, so you can check whether the same indicators appear in more recent data.

To re-run a query in Log Search:

1. On the Threat Hunt Details page, scroll to the Queries section.
2. Note the log source label displayed beneath the query you want to run. For example, LE_DNS or LE_WEB_PROXY.
3. Select Run in Log Search. Log Search opens with the query and time range pre-filled.
4. In Log Search, manually select the log source you noted in step 2.
5. Run the query to view results.

Generate threat hunt reports

You can generate two types of reports from the Threat Hunts page: a detailed report for a single hunt, or a summary report covering all hunt activity across a selected time period. Both report types are available as PDF and HTML, and can be emailed to recipients or scheduled for recurring delivery.

Generate a single-hunt report

Use a single-hunt report to share the full details of one specific hunt with stakeholders.

1. Open the Threat Hunt Details page for the hunt you want to report on.
2. In the top-right corner, select Create Report. The Create Report panel opens.
3. In the Name field, edit the report name if needed. The field defaults to the hunt name.
4. Optionally, add a Description to provide context for recipients.
5. Under Formats, select PDF, HTML, or both.
6. Leave the hunt filter as-is. Do not clear the pre-set filter.
7. Under Scheduling, the Trigger report on save toggle is on by default. The report is generated immediately when you select Create.
8. To email the report, enter one or more Rapid7-associated email addresses in the Send via email field.
9. Optionally, select Add Schedule to configure recurring delivery. For example, monthly.
10. Select Create. The report is generated and saved to Reports & Dashboards.

Generate an all-hunts summary report

Use a summary report to produce a periodic overview of all threat hunting activity. This report is useful for executive briefings and compliance reviews.

1. From the Threat Hunts list page (not a detail page), select Create Report in the top-right corner.
2. Enter a Name for the report. For example, Threat Hunts - Monthly Summary.
3. Set the Date Range using the dropdown. The default is Last 30 days.
4. Select your output Formats (PDF, HTML).
5. Toggle on Trigger report on save to generate the report immediately.
6. Optionally, add recipients in the Send via email field.
7. To automate recurring delivery, select Add Schedule and configure the cadence.
8. Select Create.

The summary report includes:

• Threat Hunt Overview - The total number of hunts conducted in the selected period.
• Hunts With Findings - The number of hunts that produced validated findings resulting in a SIEM (InsightIDR) investigation.
• Recent Threat Hunts - A table listing the most recent hunts with their name, status, source, and created date.

Access saved reports

All generated reports, whether created manually or by a schedule, are saved automatically. To access them:

1. From Command home, go to Reports & Dashboards.
2. Locate your report by name or creation date.

Quick reference

For questions about your threat hunting activity, contact your Rapid7 Cybersecurity Advisor.