Dropzone Threat Hunter

以下为收录时的原文，语言与页面不同，未做翻译。

AI Threat Hunter is an AI-based tool developed by Dropzone for autonomous threat hunting across security information and event management (SIEM), endpoint detection and response (EDR), and cloud environments. Continuously operational, this tool conducts federated, hypothesis-driven threat searches,

官网介绍

AI Threat Hunter runs autonomous, hypothesis-driven hunts across your SIEM, EDR, and cloud. The agent conducts the hunt. Your team gets analyst-ready findings.

官方常见问题

What is AI Threat Hunter?

AI Threat Hunter is an autonomous AI agent that runs federated, hypothesis-driven threat hunts across your SIEM, EDR, and cloud environments. It selects from a curated library of hunt packs, tests hypotheses against your data, and delivers findings without requiring analyst time during execution.

How does AI Threat Hunter work?

AI Threat Hunter runs a three-phase pipeline at machine scale. Search at Scale casts a wide net via federated lookups across 90+ integrations — a single hunt can surface up to half a million rows of telemetry. Filter at Scale processes that data in parallel using data science and LLMs to surface only meaningful anomalies. Investigate at Scale pursues dozens of deep-dive investigations simultaneous

What types of hunts does it run?

Five categories: Emerging Threats (indicators of compromise from just-released intelligence), Threat Actors (behaviors of groups like Scattered Spider and Lazarus mapped against your logs), Vulnerabilities (active exploitation of critical CVEs, not just scanning), ATT&CK Techniques (lateral movement, persistence, living-off-the-land below the detection threshold), and Operational Anomalies (abuse

How is this different from manual threat hunting?

Manual threat hunts require experienced analysts to switch between tools, build queries, and manually correlate results. That process typically takes 10+ hours per hunt. AI Threat Hunter completes the same process autonomously in under two hours, and runs continuously rather than episodically. Your team directs the strategy. The agent handles the execution.

Does AI Threat Hunter replace my threat hunting team?

No. AI Threat Hunter handles the manual, repetitive investigation work: cross-tool querying, log correlation, and evidence gathering that consumes most of a hunt. Your analysts focus on hypothesis development, detection engineering, and strategic response. Dropzone elevates people. It doesn't replace them.

What data sources and tools does it support?

AI Threat Hunter connects to 90+ integrations across SIEM, EDR, XDR, cloud environments, and identity platforms. It queries your tools via API, the same way your human analysts do. No data lift, no log normalization required. Your data stays where it is.