Active hunts
03↑ 1 since last week
OPERATIONS / JUL 18, 2026
Good morning, Alex.
Your team is tracking 3 live hunts across the environment.
Evidence captured
127↑ 18 this week
High-risk CVEs
08↑ 2 require attention
Hunt coverage
84%Across critical assets
IN PROGRESS
Active hunts
Suspected APT lateral movement
InvestigatingEndpoint telemetry · 18 assets in scope
Exchange Server exposure
Evidence collectionEmail infrastructure · 6 assets in scope
Cloud credential anomaly
Hypothesis validationAzure AD · 32 identities in scope
HUNT WORKSPACE
Suspected APT lateral movement
✓Scope
✓Hypothesis
3Collect evidence
4Analyse
5Report
CURRENT HYPOTHESIS
An adversary is moving laterally using compromised credentials and remote service execution.
COLLECTED EVIDENCE
08 items
4624_logon_events.csvWindows Security Logs · 2.4 MB
✓ VerifiedUnusual_RDP_connectionsMicrosoft Sentinel alert · High
✓ VerifiedAnalyst observation #4Manual note · Alex Morgan
Needs review