> For the complete documentation index, see [llms.txt](https://davidjosearaujo.gitbook.io/online-courses/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://davidjosearaujo.gitbook.io/online-courses/cyber-threat-hunting/threat-hunting-techniques-and-generative-ai/anomalies-and-baselining/searching.md).

# Searching

The simplest method of hunting, **searching** is the process of querying data for specific results or artifacts and can be performed using many tools

* Searching requires finely defined search criteria to prevent result overload
* Designing search queries effectively is an essential skill
* You don't always know what you're looking for, and queries need to be able to find useful data
* **Queries need to be:**
  * Broad enough to collect important data
  * Narrow enough to not overwhelm the analyst
  * Focused on data likely to provide usable results

## Data sources

**Knowing where to collect data is an important part of searching**

* Not all data sources are created equal

The choice of data sources to use depends on the threat

* Searching should begin based on evidence of a threat

**Examples of data sources include:**

* Flow records
* Logs
* Alerts
* System events
* Digital images
* Memory dumps

## Tools

Manually searching through collected data is impossible to do at scale

Recent development in heuristics, artificial intelligence and threat modeling are valuable for threat hunters

**While tools can help with data processing, they have limited value for analysis (i.e., they can't answer the "why")**