AI Threat Hunting in SD Unified Platform gives senior threat hunters a chat-driven workbench with five preset query libraries (Endpoint, Network, Identity, Threat Intel, MITRE ATT&CK). Reasoning-grade AI walks lateral-movement chains and validates hypotheses. Every hunt captured to the AI audit trail. Operated under NACSA SOC Licence 20007-01.
Interactive TH chat interface
Threat hunting in legacy SOCs is a query-and-pivot exercise. The analyst writes an ES query, scrolls through hits, copies a timestamp, writes a follow-up query, pivots to a different index, repeats. Hunts that should take 20 minutes take 2 hours.
SDP AI Threat Hunting replaces the query-and-pivot loop with a chat-style interface. The analyst types a hunt question — “show me anomalous outbound DNS in the last 24 hours for Tenant X” or “trace any lateral-movement indicators from this initial access alert” — and a next-generation reasoning model executes the hunt across the customer telemetry estate.
The chat surface supports:
- Multi-turn reasoning. Pivot from “show me anomalies” to “now correlate with identity events” without rewriting the query.
- Inline evidence rendering. Process trees, network flows, identity events render in the chat thread.
- Hunt artefact export. Save the hunt as an investigation packet, attach to a Zoho SDP ticket, surface in the SDP-Portal.
- Audit capture. Every hunt is logged with prompt hash, tenant scope, model, and token usage.
The chat is purpose-built for senior threat hunters — it does not pretend that AI replaces the analyst. It removes the friction between hypothesis and answer.
5 preset query libraries
Hunters launch hunts from one of five preset libraries, each curated by Simply Data SOC engineering team to reflect Malaysian-context threat patterns and MITRE ATT&CK technique coverage.
ENDPOINT
Process anomalies, suspicious child-process trees, persistence-mechanism indicators, anomalous DLL loads, registry-modification patterns, anomalous scheduled tasks. Aligned to ATT&CK Execution (TA0002), Persistence (TA0003), Privilege Escalation (TA0004), and Defense Evasion (TA0005).
NETWORK
Anomalous outbound DNS, beaconing-pattern detection, unexpected protocol use on standard ports, lateral-movement-style internal connections, exfil-pattern flows. Aligned to ATT&CK Command & Control (TA0011), Lateral Movement (TA0008), and Exfiltration (TA0010).
IDENTITY
Anomalous authentication patterns, impossible-travel events, unexpected MFA-prompt bypass, service-account anomalies, OAuth-grant abuse signals. Aligned to ATT&CK Initial Access (TA0001), Credential Access (TA0006), and Defense Evasion (TA0005).
THREAT INTEL
Hash, IP, domain, and CVE matching against curated threat intel feeds. Pivot from a single IoC into the customer estate to surface every host that has touched it. Aligned to ATT&CK Reconnaissance (TA0043) and Resource Development (TA0042).
MITRE
Direct ATT&CK technique-keyed hunts. Pick a technique (e.g. T1059.001 — PowerShell), and SDP runs the hunt with technique-appropriate detections across the estate. Useful for coverage validation against the ATT&CK matrix.
Multi-tenant investigation scope
Every hunt runs within a configurable investigation scope:
- Tenant filter. Restrict the hunt to one or more customer tenants. Senior hunters with cross-tenant clearance can hunt across the estate for cross-customer threat patterns (e.g. a new ransomware variant hitting two FIs simultaneously).
- Time range. Configurable from 15 minutes to 90 days. Default 24 hours.
- Source filter. Restrict to specific telemetry sources (endpoint, network, identity, SaaS) for focused hunts.
Multi-tenant scope is the unlock that lets a Simply Data senior hunter spot a campaign hitting multiple Malaysian banks within the first hour of indicator emergence. This is the analyst-side benefit of an MSSP with depth across regulated industries.
Powered by next-generation reasoning models
SDP AI Threat Hunting is powered by next-generation reasoning models — the class of LLM that performs multi-step retrieval and validation rather than single-shot completion.
Why reasoning models matter for hunting:
- Multi-step retrieval. A hunt question rarely answers in one query. The reasoning model decomposes the question into sub-queries, executes them sequentially, and synthesises the answer.
- Hypothesis validation. The model can propose a hypothesis (“this looks like lateral movement from host A to host B”), pull validating evidence, and either confirm or refute.
- Pivot reasoning. When evidence redirects the hunt, the model adjusts the next query rather than dead-ending.
Every reasoning call is captured to the SDP AI audit trail with prompt hash, token usage, model version, and outcome. Customers in regulated industries can request specific model whitelisting.
Read more: how SDP audits AI decisions
Sample hunt: ransomware lateral movement
A realistic hunt walk-through. (Tenant and host details fictionalised.)
Hunter prompt: “Tenant X, last 48 hours — investigate any indicators of lateral movement following the initial SMB anomaly on host APP-DB-03.”
Step 1 — Initial access correlation. AI pulls the SMB anomaly event, identifies the source IP and authentication context, surfaces the originating endpoint (WORKSTATION-MKT-12).
Step 2 — Endpoint pivot. AI queries WORKSTATION-MKT-12 process telemetry for the 4-hour window preceding the SMB anomaly. Surfaces suspicious PowerShell session with encoded payload.
Step 3 — Identity correlation. AI pulls authentication events for the user signed-in on WORKSTATION-MKT-12. Surfaces an anomalous MFA-prompt-accept event at 02:14 — outside the user’s normal pattern.
Step 4 — Lateral movement chain. AI walks the SMB session chain: WORKSTATION-MKT-12 → APP-DB-03 → APP-DB-04 → FILE-SRV-01. All within a 22-minute window. All using the same compromised credentials.
Step 5 — IoC extraction. AI extracts the encoded PowerShell payload hash, the source IP for the anomalous MFA accept, the C2 domain referenced in the decoded payload. Drafts an IoC list ready to push into Automation Hub hash-blocking.
Step 6 — Investigation packet. AI generates the customer-facing investigation narrative, attaches evidence, drafts the Zoho SDP ticket, surfaces in the SDP-Portal for the tenant security lead.
Elapsed time: under 6 minutes. The same hunt by hand against a SIEM with hand-written queries typically takes 45-90 minutes. The AI does not replace the senior hunter — the hunter is steering throughout — but it removes the query-typing tax.
Why this matters operationally
In a regulated environment — BNM RMiT 14-hour incident reporting, PDPA breach notification, Cyber Security Act 2024 reporting — the difference between a 6-minute hunt and a 90-minute hunt is the difference between meeting the regulatory window with documented evidence and missing it.
The audit chain is the second benefit. When the regulator asks “how did you determine the scope of the breach?” — SDP returns the hunt artefact: prompts, evidence pulled, conclusions drawn, model used, token cost. The investigation is reproducible.
What AI Threat Hunting is NOT
It is important to be precise about what AI Threat Hunting is and is not.
AI Threat Hunting is not:
- A replacement for senior threat hunters. The reasoning model does not invent novel detection strategy. It executes the strategy a human hunter steers. The hunter is the conductor; the model is the orchestra.
- A black-box decision-maker. Every hunt is captured to the AI audit trail with prompt hash, model, evidence pulled, and conclusions drawn. There is no “trust me, the AI said so” decision flow.
- A standalone product. AI Threat Hunting is a module of SD Unified Platform. It depends on the ingestion layer (SD Monitoring), the agentic AI infrastructure (SCC), the ticketing source of truth (Zoho SDP integration), and the customer-facing portal (SDP-Portal).
- A replacement for endpoint detection. AI Threat Hunting investigates; it does not detect at the endpoint. EDR detection remains the responsibility of the vendor agent (Trend Micro, Palo Alto Cortex XDR, FortiEDR, Microsoft Defender) in the customer estate.
Being precise about scope makes SDP defensible in front of an RFP committee. Vendors who over-claim get caught at the technical-due-diligence stage.
How AI Threat Hunting is operated
AI Threat Hunting is operated by the Simply Data SOC team on behalf of customers. Customer-facing visibility into hunt activity, MITRE technique coverage, and hunt outcomes is exposed through the SDP-Portal.
Hunt cadence:
- Continuous L1/L2-driven hunts — agentic AI triage in the Security Command Centre routinely surfaces patterns that warrant a deeper hunt; the SOC team picks these up and drives them through AI Threat Hunting.
- Scheduled hunts — Simply Data SOC team runs scheduled MITRE-technique coverage hunts for each tenant on a documented cadence (typically weekly for critical-tier tenants).
- Ad-hoc hunts — driven by emerging threat intelligence (e.g. a new ransomware variant emerging in regional FI), regulatory advisories (MyCERT, BNM bulletins, NACSA advisories), or customer requests.
- Incident-driven hunts — every confirmed incident triggers a post-incident hunt to ensure full scope is understood and no related indicators are missed.
Customers can request specific hunts through their account manager or through the SDP-Portal ticket interface. Hunt artefacts are attached to the customer ticket and visible in the portal investigation history.
Why Customers Choose Simply Data AI Threat Hunting
Six outcomes that matter to procurement, compliance, and operations teams.
Senior Hunters Spend Time on Judgement
Reasoning AI handles boilerplate retrieval. Analysts focus on validating hypotheses and pivoting techniques — not typing ES queries.
Lower Floor for New Analysts
Day-one contribution without learning Elasticsearch syntax. Chat lowers the cost of senior-analyst output.
Hunt Across the Whole Portfolio
For MSSPs and multi-tenant FIs: sessions can span multiple tenants, configurable time ranges, filtered scope.
Auditable Hunt Evidence
Every query and AI response captured. Time-to-investigation visible as a hard SLA metric for customers and regulators.
Reasoning, Not Just Keyword Search
Next-generation reasoning models with retrieval-augmented context from prior incidents and threat intelligence feeds.
MITRE-Aligned Coverage
Hunts auto-tagged with MITRE techniques. Per-tenant technique heatmaps surface in SDP-Portal.
Frequently Asked Questions
What is AI Threat Hunting?▾
AI Threat Hunting is a chat-driven senior analyst workbench inside SDP. Hunters drive the investigation in natural language; reasoning-grade AI retrieves telemetry, builds context, and proposes the next pivot.
Which query libraries are available?▾
Five preset libraries: Endpoint, Network, Identity, Threat Intel, and MITRE ATT&CK.
Can hunts span multiple tenants?▾
Yes. Senior hunters can scope a session to multiple tenants with configurable time ranges and tenant filters.
How is AI Threat Hunting audit-trailed?▾
Every hunt query and AI response is captured to the AI audit log with model version, prompt hash, latency, and token count.
What models does AI Threat Hunting use?▾
Next-generation reasoning models routed through a single audited choke point.
Does AI Threat Hunting replace senior analysts?▾
No. AI Threat Hunting accelerates senior analysts. Humans drive; AI does retrieval and chain-walking.
How does MITRE ATT&CK mapping work?▾
Hunts are tagged with the MITRE techniques the analyst pivots through. Coverage metrics surface in SDP-Portal.
Is AI Threat Hunting available for non-SOC customers?▾
AI Threat Hunting is a module of SDP — it ships with the SOC Managed Service.
Other SDP Modules
Explore the rest of SD Unified Platform.
Get Your Free Consultation Now!
We’re here to help! Contact us to learn more about AI Threat Hunting and SD Unified Platform.
Talk to a Simply Data engineer
Pre-launch briefings include a live walk-through of AI Threat Hunting on a sanitised demo tenant. Engineers — not sales reps — answer technical questions.
Reserve a Demo Briefing →Or reach us directly: