1.4.2. The Detect, Hunt, Respond, Automate Loop
💡 First Principle: No detection set is complete, so a mature SOC treats security operations as a feedback loop. Detections catch known patterns; hunting searches for what detections missed; response contains and remediates what either one finds; automation takes the repeatable parts of response and makes them instant. Each finding improves the next turn of the loop.
The loop maps directly onto the exam's three domains. Detect and Automate are configuration work in "Manage a security operations environment": custom detections, analytics rules, automation rules, playbooks, AIR, and attack disruption. Respond is "Respond to security incidents": investigating and remediating across Defender products, Sentinel, and Microsoft 365. Hunt is "Perform threat hunting": advanced hunting, graphs, Sentinel hunting queries, KQL jobs, and notebooks.
The connections between stages are where design questions live. A hunt that finds something valuable should graduate into a detection rule so it never needs manual hunting again; Defender XDR lets you create a custom detection rule directly from an advanced hunting query, and Sentinel hunting queries can be promoted to analytics rules. A response step that analysts perform the same way every time, such as disabling an account and revoking its sessions after confirmed compromise, should become an automation rule or playbook. When the exam asks for the "least administrative effort" way to make a manual task repeatable, it is asking you to move work from Respond to Automate.
⚠️ Exam Trap: Hunting does not raise alerts by itself. A hunting query runs when an analyst runs it. If the requirement is "be alerted whenever this pattern recurs," the answer is a detection (custom detection rule or analytics rule) built from the query, not a saved hunting query.
Reflection Question: A threat hunter finds that attackers used a renamed copy of a legitimate admin tool to move laterally. Trace what should happen next at each stage of the loop so the organization catches the same behavior automatically next time.
