Proactive search for cyber threats within already compromised or potentially at-risk networks and systems, through behavioral analysis, event correlation, and advanced investigative techniques. Includes detection methodologies based on hypothesis-driven investigation, threat intelligence, and anomaly detection to identify malicious activity not detected by traditional automatic controls.