# Threat Hunting

URL: https://www.deepinfo.com/solutions/use-cases/threat-hunting/

## Test the Hypothesis Against the Whole Index.

A hunt starts with a hunch: this actor is looking at our sector, this pattern keeps coming back, this CVE is being used against organizations like ours. Threat Hunting checks it against the index behind the Deepinfo Platform and a CVE database enriched with EPSS and CISA KEV.

[Request demo](https://www.deepinfo.com/request-demo/) · [Discovery API reference](https://docs.deepinfo.com/reference/discovery/)

### The Hypotheses a Hunt Starts From.

Indicator-driven

#### Start From an IOC

An IP, a domain, a mail server or a registrant email from an alert. Reverse lookups return every domain that shares it, and each result is a new starting point.

Actor-driven

#### Start From an Actor

Filter Threat Actor Intelligence by the countries and industries you operate in, read the CVEs and tools each actor uses, then look for those CVEs on your surface.

Pattern-driven

#### Start From a Pattern

Describe the infrastructure you expect to find: one name server, a registration window, mail servers in place. Domain Search returns what matches.

### Describe the Infrastructure and Get the Matches.

Domain Search filters the whole domain dataset on names, subdomains, WHOIS, DNS, IP history, SSL and web data, with `must`, `should` and `must_not` logic.

The request here looks for domains on one name server, registered since the start of August 2026, that already have mail servers. Swap the filters and that request tests a different hypothesis.

Results come back as full domain records, paged or exported as JSON or CSV.

[Domain Search reference](https://docs.deepinfo.com/reference/discovery/domain-search/)

Domain Search

```bash
curl -X POST \
  "https://api.deepinfo.com/v1/discovery/domain-search?page_size=25" \
  -H "apikey: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "filters": {
      "must": [
        { "name": "dns.ns.name_servers", "type": "eq",
          "value": "ns1.dns-host.example" },
        { "name": "domain.whois.create_date", "type": "gte",
          "value": "2026-08-01T00:00:00Z" },
        { "name": "dns.mx.mail_servers", "type": "exists", "value": true }
      ]
    }
  }'
```

### The Pivots a Hunt Keeps Reaching For.

Each question is one request. The answer is a list of domain records, and any field in them can seed the next request.

| Question | Endpoint | Returns |
| --- | --- | --- |
| What else sits on this IP or network? | `GET /discovery/reverse-ip` | Domains resolving to an IP, or to its /8, /16 or /24 network |
| What else uses this mail server? | `GET /discovery/reverse-mx` | Domains using the mail server, or the whole mail domain with `apex` |
| What else uses this name server? | `GET /discovery/reverse-ns` | Domains using the name server |
| What else did this registrant register? | `GET /discovery/reverse-email` | Domains whose WHOIS registrant email matches |
| What was registered alongside it? | `GET /discovery/sametime-domain-finder` | Domains the same registrant registered within 1 to 60 minutes |
| What shares its registrant or servers? | `GET /discovery/associated-domain-finder` | Domains sharing registrant email, organization or phone, name servers, IP, mail servers or SSL organization |
| What did it resolve to before? | `GET /analyze/dns-history` | Every distinct DNS value observed, with the times it was seen |
| Which CVEs fit the profile? | `POST /discovery/vulnerability-search` | CVEs filtered on their full record, including EPSS and CISA KEV |

Parameters and response fields are in the [Discovery](https://docs.deepinfo.com/reference/discovery/) and [Vulnerability](https://docs.deepinfo.com/reference/vulnerability/) references.

### From an Actor Profile to Your Assets.

1. **Select**

   Search [Threat Actor Intelligence](https://www.deepinfo.com/platform/cti/threat-actor-intelligence/) for actors that target your countries or your industry.
2. **Read**

   Take the CVEs each remaining actor is known to use from its capabilities, along with its tools.
3. **Rank**

   Look each CVE up with its EPSS probability and CISA KEV status, and put the exploited ones first.
4. **Check**

   Search your [External Attack Surface Management](https://www.deepinfo.com/platform/easm/) inventory for those CVEs. What comes back is the hunt’s answer, or its next question.

### Where Hunts Lead Next.

- [Domain Intelligence and Research](https://www.deepinfo.com/solutions/use-cases/domain-intelligence-and-research/) (Use case): Pivots, searches and registration statistics on the domain layer.
- [Incident Investigation and Response](https://www.deepinfo.com/solutions/use-cases/incident-investigation-and-response/) (Use case): The index, pointed at an open incident.
- [A cybersecurity ratings provider](https://www.deepinfo.com/customers/cybersecurity-ratings-provider/) (Customer story): Builds its own product on the index, through APIs and Data Feeds.

### Use This Data in Your Tools

Analysts can pivot through these records from their own tools: what else sits on an IP address, what a domain resolved to before, and who registered it.

- [Reverse IP API](https://www.deepinfo.com/data-api/apis/reverse-ip/)
- [DNS History API](https://www.deepinfo.com/data-api/apis/dns-history/)
- [WHOIS History API](https://www.deepinfo.com/data-api/apis/whois-history/)
- [Reverse WHOIS Email API](https://www.deepinfo.com/data-api/apis/reverse-whois-email/)

### Questions About Threat Hunting

**Do hunts need the platform or the API?**

Either. Analysts run searches and pivots in [Deep Search & Insights](https://www.deepinfo.com/platform/dsi/), and the same queries are REST endpoints behind one `apikey` header, so a hunt that works once can be scheduled.

**How fresh is the data behind a pivot?**

WHOIS, DNS, IP WHOIS and SSL lookups query the target or its registry at request time and stamp each answer with `check_date`. Finders, searches and history read what the index has observed, with the times each value was seen.

**Can results be exported in bulk?**

Yes. The Discovery finders and the searches take `export=true` and return JSON or CSV. A single search returns a capped number of results, so broad hunts get narrowed with filters rather than paged.

**Does an empty result mean the infrastructure doesn’t exist?**

No. It means the index holds no match. A host can run for a while before Deepinfo first observes it, so an empty answer is a reason to widen the hypothesis before ruling it out.

**What are the API rate limits?**

They depend on your plan and apply per key and per endpoint, one request per second by default. Responses carry headers with the remaining allowance, so a scheduled hunt can pace itself. See [rate limits](https://docs.deepinfo.com/getting-started/rate-limits/).

**Where do IOC feeds fit?**

Indicator-driven hunts often start from one. [IOC Feeds](https://www.deepinfo.com/platform/cti/ioc-feeds/) cover the indicators the platform structures, such as lookalike domains, dark web indicators and the CVEs actors use, scoped with your team.

### Bring a Hypothesis. We’ll Run It Live.

Book a working session and test a hunting hypothesis of yours against the index with our team.

[Request demo](https://www.deepinfo.com/request-demo/)