threat hunting

Proactively searching logs from a hypothesis, such as stolen VPN credentials, when no alert has fired.

Where the book teaches it