---
title: "Discussion on \"Attack-Based vs Data-Based Threat Hunting: Two Ways to Start\" | Hashnode"
description: "Discussion on \"Attack-Based vs Data-Based Threat Hunting: Two Ways to Start\". Study notes on two threat hunting approaches: starting from an attack (ABH) or from a data source (DBH), with Windows Event ID examples."
url: "https://hashnode.com/posts/attack-based-vs-data-based-threat-hunting/6af14d766ce2dd689d52b446"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [Attack-Based vs Data-Based Threat Hunting: Two Ways to Start](https://matin-ghorbani.hashnode.dev/attack-based-vs-data-based-threat-hunting?utm_source=hashnode&utm_medium=feed)

Study notes on two threat hunting approaches: starting from an attack (ABH) or from a data source (DBH), with Windows Event ID examples.

3d ago · 6 min read · matin-ghorbani.hashnode.dev  
Read the article

-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#threat-hunting](https://hashnode.com/tag/threat-hunting)
-   [#blue-team](https://hashnode.com/tag/blue-team)
-   [#windows](https://hashnode.com/tag/windows)
-   [#siem](https://hashnode.com/tag/siem)

## Written by

[Matin Ghorbani](https://hashnode.com/@matin-ghorbani)

@matin-ghorbani

  
[View profile](https://hashnode.com/@matin-ghorbani)

Computer Engineering student sharing my journey through Linux, Networking, and Systems Administration.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.