Threat hunting
Proactively searching your environment for attacker activity that has not triggered any alert.
Hunting assumes detection has gaps, because it always does. Instead of waiting for a rule to fire, an analyst starts from a hypothesis, such as an attacker using legitimate remote tooling, and goes looking through telemetry for evidence of it.
It requires retained data and someone who knows what normal looks like in your specific environment. Findings usually feed back into new detection rules, so a hunt improves automated coverage as well as catching what it catches.
Where this comes up
Threat hunting sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.