SANS San Antonio Spring 2025: SANS@Night - How to Tell a Story When Threat Hunting

Effective threat hunting is about more than just knowing where to find technical artifacts — it’s about making sense of the clues and telling a clear, meaningful story. In this session, we’ll explore how to craft a narrative that connects the dots between artifacts, attacker behavior, and business risk to help teams understand what happened, why it matters, and what to do next. You’ll learn simple ways to structure your findings, communicate with both technical and non-technical audiences, and make sure your hunts tell a story.