https://threat-foundry.com/blog.htmlPractical guidance for review-first threat operations.en-usTue, 14 Jul 2026 00:00:00 GMThttps://threat-foundry.com/blog/ai-assisted-threat-hunting-review-first.htmlhttps://threat-foundry.com/blog/ai-assisted-threat-hunting-review-first.htmlHow AI can accelerate hunt generation, CTI summarization, Sigma drafting, and YARA drafting while keeping analysts in control.AI and Huntinghttps://threat-foundry.com/blog/community-sigma-yara-detection-exchange.htmlhttps://threat-foundry.com/blog/community-sigma-yara-detection-exchange.htmlHow Threat Foundry approaches opt-in community sharing for Sigma and YARA detections while keeping customer rules private by default.Detection Engineeringhttps://threat-foundry.com/blog/cti-modeling-metric-weights-threat-foundry.htmlhttps://threat-foundry.com/blog/cti-modeling-metric-weights-threat-foundry.htmlHow to use Threat Foundry CTI Modeling, reporting, Auto Triage, and Metric Weights to tune CTI prioritization without creating noisy queues.Threat Intelligencehttps://threat-foundry.com/blog/detecting-lateral-movement-threat-foundry.htmlhttps://threat-foundry.com/blog/detecting-lateral-movement-threat-foundry.htmlHow Threat Foundry helps teams hunt and detect lateral movement across identity, endpoint, network, cloud, and asset context.Threat Huntinghttps://threat-foundry.com/blog/dfir-feedback-loop-detection-engineering.htmlhttps://threat-foundry.com/blog/dfir-feedback-loop-detection-engineering.htmlWhy incident response should produce reusable intelligence, Sigma/YARA candidates, playbooks, and telemetry improvements.Incident Responsehttps://threat-foundry.com/blog/enterprise-detection-engineering-at-scale.htmlhttps://threat-foundry.com/blog/enterprise-detection-engineering-at-scale.htmlWhy large security programs need repeatable detection lifecycle management, field normalization, evidence review, and reporting around Sigma, YARA, and hunt workflows.Enterprise Securityhttps://threat-foundry.com/blog/kev-catalog-vulnerability-intelligence.htmlhttps://threat-foundry.com/blog/kev-catalog-vulnerability-intelligence.htmlHow CISA KEV can help security teams prioritize exploited vulnerabilities, scope exposure, trigger hunts, and drive detection work.Vulnerability Intelligencehttps://threat-foundry.com/blog/midsize-business-detection-program.htmlhttps://threat-foundry.com/blog/midsize-business-detection-program.htmlHow midsize organizations can build useful threat hunting and detection workflows without needing enterprise-scale tooling or staff.Midsize Businesshttps://threat-foundry.com/blog/msp-threat-hunting-without-adding-headcount.htmlhttps://threat-foundry.com/blog/msp-threat-hunting-without-adding-headcount.htmlA practical model for MSPs and MSSPs to package CTI-led hunting, detection review, and customer reporting with repeatable workflows.MSP Strategyhttps://threat-foundry.com/blog/practical-yara-for-incident-response.htmlhttps://threat-foundry.com/blog/practical-yara-for-incident-response.htmlHow IR teams can use YARA to turn malware traits, strings, and file artifacts into reviewable detection content.YARA and DFIRhttps://threat-foundry.com/blog/soc-analyst-workflow-from-cti-to-triage.htmlhttps://threat-foundry.com/blog/soc-analyst-workflow-from-cti-to-triage.htmlHow SOC teams can move from raw intelligence to reviewed hunts, detections, triage, and cases without turning every feed item into work.SOC Operationshttps://threat-foundry.com/blog/threat-foundry-living-off-the-land-hunting.htmlhttps://threat-foundry.com/blog/threat-foundry-living-off-the-land-hunting.htmlHow to use Threat Foundry to hunt living off the land attacks by turning legitimate-tool abuse into reviewed ATT&CK-driven hunts, Sigma candidates, and evidence.Threat Huntinghttps://threat-foundry.com/blog/threat-hunting-in-the-cloud.htmlhttps://threat-foundry.com/blog/threat-hunting-in-the-cloud.htmlA provider-neutral model for cloud threat hunting built around identity, control-plane activity, data movement, workload runtime, and the MITRE ATT&CK Cloud matrix.Cloud Huntinghttps://threat-foundry.com/blog/threat-hunting-aws-cloudtrail-guardduty-security-lake.htmlhttps://threat-foundry.com/blog/threat-hunting-aws-cloudtrail-guardduty-security-lake.htmlHow to build AWS threat hunts around CloudTrail, GuardDuty, Security Lake, IAM, S3, EKS, runtime telemetry, and the MITRE ATT&CK Cloud matrix.Cloud Huntinghttps://threat-foundry.com/blog/threat-hunting-microsoft-azure-entra-sentinel-defender.htmlhttps://threat-foundry.com/blog/threat-hunting-microsoft-azure-entra-sentinel-defender.htmlHow to build Azure cloud hunts around Entra ID, Activity Logs, Defender XDR advanced hunting, Microsoft Sentinel, hybrid identity, and the ATT&CK Cloud matrix.Cloud Huntinghttps://threat-foundry.com/blog/threat-hunting-google-cloud-security-command-center-secops.htmlhttps://threat-foundry.com/blog/threat-hunting-google-cloud-security-command-center-secops.htmlHow to build Google Cloud hunts around Security Command Center, Google Security Operations, IAM, service accounts, BigQuery, GKE, Cloud Run, and the ATT&CK Cloud matrix.Cloud Huntinghttps://threat-foundry.com/blog/threat-hunting-charter-before-tools.htmlhttps://threat-foundry.com/blog/threat-hunting-charter-before-tools.htmlHow mature hunt programs define mission, scope, PIRs, authority, cadence, and handoffs before scaling technology.Threat Hunting Programhttps://threat-foundry.com/blog/threat-intelligence-sharing-collective-defense.htmlhttps://threat-foundry.com/blog/threat-intelligence-sharing-collective-defense.htmlWhy threat intelligence sharing is a force multiplier when it is timely, trusted, contextual, and tied to hunt and detection workflows.Threat Intelligencehttps://threat-foundry.com/blog/ttp-driven-hunting-beats-ioc-chasing.htmlhttps://threat-foundry.com/blog/ttp-driven-hunting-beats-ioc-chasing.htmlWhy durable threat hunting starts with adversary behavior, not just disposable indicators.Threat Huntinghttps://threat-foundry.com/blog/getting-the-most-from-threat-blueprints.htmlhttps://threat-foundry.com/blog/getting-the-most-from-threat-blueprints.htmlA practical guide to turning architecture context, data flows, attack paths, findings, and remediations into an operating security workflow.Threat Blueprintshttps://threat-foundry.com/blog/leveraging-cti-across-threat-foundry.htmlhttps://threat-foundry.com/blog/leveraging-cti-across-threat-foundry.htmlMove selected intelligence through normalization, review, prioritization, hunting, detection, investigation, and reporting without losing provenance.Threat Intelligence