Threat Hunting
Did something happen in your environment?
A threat hunt answers that question from evidence, by default over a time window of the last 30 days. It runs inside your own Microsoft 365 tenant using Microsoft Defender XDR advanced hunting. It is not a configuration check and not a pentest.
A monthly subscription: one curated threat hunt every month.
What we hunt
Three kinds of hunt
You choose what to answer: pose a specific question, or ask us to hunt for whatever is most relevant to your organisation. Either way, SAKA, our AI team, works only from the evidence in your tenant.
Threat-intel driven
We hunt a specific campaign's indicators and techniques: domains, hashes and TTPs from current threat intelligence.
Hypothesis driven
A question about behaviour, answered clearly as supported, rejected or inconclusive.
Identity sweeps
A focused sweep of sign-in and identity activity for signs of account compromise or misuse.
Where we look
Microsoft Defender XDR advanced hunting
We query the telemetry already in your Microsoft 365 tenant with KQL, read-only. Coverage depends on what Defender collects:
Process events
Process creation with full command lines.
Network connections
Outbound and inbound connection events.
Sign-ins & identity
Authentication and identity activity across accounts.
Email metadata
Message metadata only, never message content.
Cloud-app activity
Activity across connected cloud applications.
Alerts
Existing Defender alerts, correlated into the hunt.
The report
One clear verdict, then the evidence
You receive a report in English or Dutch (Markdown and HTML) that opens with a single, plain verdict:
After the verdict: scope, findings, a timeline, indicators, the evidence behind each conclusion, coverage gaps (empty or missing tables) and recommended follow-up hunts.
SAKA runs the hunt, but a person reviews every report before it reaches you. Hunting is evidence work, not pure automation. An early report once contained a finding that was demonstrably wrong, which is exactly why human review is part of the service.
Access & control
Minimal access, fully in your hands
The hunt reads telemetry and nothing else. You stay in control of the access at every step.
Read-only, one permission
A single Microsoft permission: ThreatHunting.Read.All. We can read hunting data and nothing else.
No account, no password
We never need a user account or a password in your tenant.
Every access is visible
You can see every access in your own Entra sign-in logs.
Full query log
We keep a log of every query we run, which you can request at any time.
Revoke any time
You can withdraw our access at any time from Enterprise applications.
Data stays in the Netherlands
Hunt data is stored in the Netherlands on AKASEC equipment and deleted after about a month.
Scope
What a threat hunt is not
- Consent is not authorization. A hunt only runs once AKASEC has authorized your tenant and a person has scoped the work. Granting access never starts a hunt by itself.
- No response actions. We never isolate devices or block accounts. We recommend; you act.
- Every report is reviewed by a person before delivery.
- No Microsoft Sentinel or Log Analytics. The method is deliberately scoped to Defender XDR advanced hunting.
- No continuous monitoring and no automated weekly CVE hunts. Each hunt is a scoped, point-in-time engagement.
Onboarding
One consent link, opened by your own admin
Onboarding is a single Microsoft consent link that your organization's Global Administrator (or Privileged Role Administrator) opens. It grants the read-only ThreatHunting.Read.All permission to our multi-tenant app. We never click consent on your behalf.
On the Microsoft consent screen you'll see the app named “AKASEC Threat Hunting”. Until our publisher verification is complete, Microsoft may show an “unverified publisher” notice. With a subscription, consent stays in place while you're subscribed, you revoke it when you cancel, from Enterprise applications → AKASEC Threat Hunting → Delete. A guided consent flow is coming to this site.
Start a monthly threat hunt
A fixed monthly subscription, one curated, human-reviewed threat hunt every month, in your own Microsoft 365 tenant. Tell us your tenant and either the question you want answered, or that we should hunt for what's most relevant to you.