By Julian Meyrick, Managing Partner & Vice President, Security Strategy Risk & Compliance, Security Transformation Services, IBM Security

Cyber threat hunting — proactively chasing increasingly sophisticated and pervasive cyberattacks — has been around for some time. However, existing approaches of cyber threat hunting rely on repeated and tedious knowledge encoding on specific data platforms, which can be very time-consuming.

In cybersecurity, time is of the essence. Every hour it takes to detect and respond to a threat leaves attackers more time to do damage. Unfortunately, rather than benefiting from the threat-hunting community’s collective knowledge and sharing code, cybersecurity professionals end up working in relative isolation and rewriting the same programs over and over with each new attack. In this context, the value of an open-source threat-hunting programming language could help solve that issue.

Kestrel Threat Hunting Language offers threat hunters a means to perform cyber reasoning and threat discovery much faster and easier than ever before. Developed jointly by IBM Research and IBM Security and based on years of experimentation in DARPA’s Transparent Computing program’s adversarial engagements, Kestrel offers Security Operations Center (SOC) analysts and threat hunters a domain-specific language that lets them devote more time to figuring out what to hunt, as opposed to how to hunt.

Letting threat hunters do what they do best

Cyber threat hunting is intended to serve as a countermeasure against today’s threats, many of which are built dynamically and customized to attack specific targets. These stealthy attacks can circumvent existing security measures at various levels and cannot be fully captured by pre-programmed detection systems and analytics.

Even with the influx of numerous open-source and commercial investigation tools, cyber threat hunting lacks the efficiency needed to be truly effective. Time and intelligence that should be focused on reasoning about sophisticated threats is instead spent on mundane tasks, such as crafting queries for different data sources, interpreting their results, and recording those results in spreadsheets.

IBM designed Kestrel to codify different steps and flows involved in threat hunting. That includes understanding the security measures in the target environment, thinking about potential threats that escape existing defenses, obtaining useful observations from system and network activities, developing threat hypotheses, revising threat hypotheses iteratively with the last two steps, and confirming new threats.

As a language for threat hunters to express what they are hunting, Kestrel helps hunters organize their thoughts about threat hypotheses around entities, which include numerous identifiable systems or network objects.

Under the hood, Kestrel runtime automatically reassembles an entity using pieces of information from different records or logs that describe different aspects of that entity. Kestrel also proactively asks data sources for additional information about different entities in order to ensure threat hunters have all of the information available to track down root causes and impacts of suspicious activity, as well as create and revise threat hypotheses as needed.

Security in community

Kestrel uses Structured Threat Information Expression (STIX), an open-standard for expressing and exchanging cyber threat data and intelligence. Kestrel runs on top of STIX-Shifter — another open source project by IBM Security — to automatically compile threat-hunting steps down to the native languages that the different data sources speak and execute. Beyond patterns, Kestrel abstracts hunting knowledge codified in analytics and hunting flows. Shareable, composable and reusable threat-hunting flows are critical — look no further than the SolarWinds attack to understand the importance of sharing threat intelligence and analysis across multiple organizations.

Ultimately, Kestrel will give threat hunters the ability to focus on the most interesting aspect of their work — the thrill of the hunt. In doing so, it will make cyber threat hunting more exciting that ever, and allow cybersecurity professionals to spend their time and energy untangling sophisticated threats and raising the level of skill and effort required to launch successful attacks in the future.

 

You may also like

Advancing Regulatory Alignment at RSA Conference 2025
icon External Engagement

Advancing Regulatory Alignment at RSA Conference 2025

In the face of rising global cyber threats, over 50 CISOs have called for greater international alignment of cybersecurity regulations to strengthen defenses and reduce fragmentation. This message was echoed at RSAC 2025, where experts from the OECD, European Commission, academia, and industry emphasized the need for principle-based collaboration. The Charter of Trust, a long-time advocate for regulatory harmonization, continues to support coordinated, effective approaches that prioritize clarity over complexity.
May 01, 2025
Richards Skalt takes over the Advocacy Workstream
icon External Engagement

Richards Skalt takes over the Advocacy Workstream

We are delighted to welcome Richard Skalt, Advocacy Manager at TÜV SÜD, as the new Leader of the Advocacy Workstream at the Charter of Trust. Richard steps into the role following María del Pino González-Junco, who recently assumed the position of Chair of the Global External Engagement Working Group.

With a strong background in advocacy and a forward-looking vision, Richard brings renewed energy to our mission of shaping a secure digital future. As he puts it:

“My motivation is to preserve and build upon the strong foundation of advocacy activities we’ve developed over the past years. At the same time, I’m committed to ensuring we’re in a position to shape the policies that will define how our business model and operations evolve in the future – including the cybersecurity of products and systems, the use, deployment, and distribution of robust AI solutions, as well as cloud security and secure datacenters.”

In a world defined by accelerating digital transformation and increasingly complex regulatory challenges, principled leadership and effective collaboration are more vital than ever. Under Richard’s leadership, the Advocacy Workstream will continue to engage policymakers, raise public awareness, and strengthen education around key issues such as cybersecurity, AI governance, and secure digital infrastructures.
April 29, 2025
New Chairwoman for the Global External Engagement Group
icon External Engagement

New Chairwoman for the Global External Engagement Group

The Charter of Trust is proud to announce María del Pino González-Junco, Cybersecurity Alliances Manager at Siemens, as the new Chairwoman of the Global External Engagement Working Group. Her appointment marks a significant step forward in our shared mission to advance cybersecurity through strong international collaboration.

Pino’s election follows a dynamic Collaboration Week in Denmark, where Charter of Trust partners from around the world came together to align on strategy, strengthen partnerships, and reaffirm our commitment to a secure digital future. As a longstanding leader within the advocacy workstream, Pino has been instrumental in fostering open dialogue with key external stakeholders and promoting cybersecurity awareness across industries and institutions.

“A reliable digital world can only thrive if public and private institutions build trust and cyber-resilience together, share their expertise, and support society in this digital journey. Those are our goals at the Charter of Trust,” says Pino.

She takes over the role from Sumit Chanda, COO/CISO at Atos, who has guided the working group with vision and energy. We are pleased to share that Dr Chanda has since been elected Co-Chair of the Charter of Trust by the Board of Directors in February—ensuring his continued impact on the initiative’s strategic direction.

We extend our sincere thanks to Sumit for his outstanding leadership and warmly congratulate Pino on her new role.
April 24, 2025