In one paragraph
An autonomous hunt report is the system's account of one hunt: what it looked for, where, how, what it found and what it proposes next. A report worth trusting lets a reviewer repeat the hunt from the report alone. A clean result is only as good as the data and time range behind it, so the report should say what was not checked as clearly as what was.
Guide updated September 2026 · Autonomous Threat Hunting editors
2 min read
Use these six checks on any hunt report, in a trial or in production.
1. Is the hypothesis stated?
The report should name the behavior it looked for, ideally with the ATT&CK technique, and the intelligence that prompted it. A report that opens with results has skipped the question.
2. Which data, over what time range?
Look for each source by name, the time window, and any source that was unavailable during the hunt. A hunt that could not reach identity logs cannot rule out an identity-based technique.
3. Are the exact queries shown?
The queries should be copyable into the data platform so a person can run them again. A description of the queries is not enough, because it hides the filters and time bounds that decide what was actually searched.
4. How were hits corroborated?
For each finding, the report should list the other sources checked and whether they supported or contradicted it. See corroboration in the glossary.
5. What does a clean result mean?
No hits means nothing matched these queries in this data over this window. It does not mean the technique is absent from the environment. The report should say so, and the risks page calls the opposite reading false confidence.
6. What is proposed next, and who decides?
A proposed detection, a follow-up hunt or a staged action should each name the approval it needs. The lesson on designing a human approval step covers what that step should look like.
Try the six checks on one finding and one clean result from a vendor trial. The checklist covers what to ask about reports before the trial starts.
Keep a copy of every report you judge
During a trial, save each report you review with your verdict and the time the review took. Two things come out of that record. First, a list of the checks that failed most often, which tells you what to raise with the vendor. Second, a measured review time per finding, which is the number the review-time calculator needs. Both are more useful than any figure on a product page, because they come from your data and your reviewers.