Elastic Certified SIEM Analyst

Which statement best characterizes threat hunting as practiced in Elastic Security?