- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
In 2026, India’s enterprise cyber-threat landscape has changed irrevocably. Attackers no longer announce themselves with noisy malware alerts that trip your signature-based controls. They arrive through stolen credentials, legitimate remote-access tools, and trusted third-party channels — and then they wait. The average dwell time for an advanced persistent threat (APT) inside an Indian enterprise before detection is still measured in weeks, sometimes months. During that window, they map Active Directory, exfiltrate intellectual property, and position ransomware payloads to fire at maximum impact.
Reactive security — waiting for an alert to fire — is no longer enough. The discipline that separates resilient Indian enterprises from breach statistics is proactive threat hunting: the continuous, hypothesis-driven search for adversary behaviour that has already evaded your automated controls. This guide explains how your security team can operationalise threat hunting using FortiGate telemetry, the PrahiX Ora SecOps platform, and a structured MITRE ATT&CK methodology.
Most enterprise security stacks are built around known-bad indicators: malware signatures, known-malicious IP lists, CVE-specific IDS rules. These controls work well against commodity threats — script-kiddie scans, opportunistic ransomware, bulk phishing. They fail against the adversaries that cause the most catastrophic breaches, for three reasons:
CERT-In’s 2025 annual threat report noted a significant uptick in targeted intrusions against Indian manufacturing and logistics sectors, many involving dwell times that allowed attackers to move laterally to ERP and OT systems before detection. Threat hunting closes this gap.
Effective threat hunting is structured, not random. The three-phase approach used by mature SOC teams:
A threat hunt begins with a specific, testable hypothesis grounded in threat intelligence. Examples relevant to Indian enterprises in 2026:
Hypotheses should be prioritised based on your industry’s threat profile. For Indian BFSI, focus on credential harvesting and fraudulent transaction injection. For pharmaceuticals and IT services, prioritise intellectual property staging and exfiltration. For manufacturing, OT-targeting TTPs from groups known to operate in the region deserve immediate attention.
A hypothesis is only testable if you have the right telemetry. This requires log sources across the full kill chain:
Once collected and centralised, the hunter runs structured queries — using KQL, Lucene, or SIGMA rules — to surface anomalous patterns consistent with the hypothesis. A good SIEM platform should make this workflow fast and repeatable.
Positive findings are escalated to incident response. Negative findings — equally valuable — confirm either clean environment or a need to refine the hypothesis. Either way, the hunt produces a documented playbook that can be automated into detection rules, shrinking future dwell time.
For Indian enterprises already running FortiGate next-generation firewalls, a rich vein of threat-hunting telemetry is already being generated — it just needs to be fully utilised.
With deep SSL inspection enabled on FortiGate, the firewall decrypts, inspects, and re-encrypts outbound HTTPS traffic. This exposes C2 beaconing patterns that would otherwise be invisible. Hunters should look for sessions with:
FortiGate’s application control module can identify unusual use of Windows administrative tools traversing the network. Lateral movement via PsExec or SMB admin shares (T1021.002) generates identifiable FortiGate application signatures. DNS request logs from FortiGate reveal domain generation algorithm (DGA) patterns — malware that generates random domains — which no signature-based control will catch but which stands out clearly in frequency and entropy analysis.
FortiGate, integrated with FortiAnalyzer, can establish baseline traffic profiles per user or device. A developer workstation that suddenly initiates outbound RDP to ten internal servers at 2 AM deviates significantly from its normal profile — a classic lateral movement indicator. Hunting on deviation from established baselines is one of the most reliable ways to surface credential misuse.
Threat hunting at scale requires a platform that aggregates telemetry from every layer, enables rapid querying, and accelerates response when a hunt surfaces a live threat. PrahiX Ora is the unified SecOps platform we deploy and operate for clients — built by PrahiX Tech Pvt Ltd and designed to support exactly this kind of structured, continuous hunt workflow across Indian enterprise environments.
PrahiX Ora’s SIEM layer ingests logs from FortiGate, FortiMail, Active Directory, cloud providers, and endpoint agents into a single, queryable data store. Correlation rules are mapped directly to MITRE ATT&CK technique IDs, so hunters can move from a hypothesis (“look for T1059.001”) to a pre-built query in seconds rather than building detection logic from scratch.
The platform’s graph-based attack storyline reconstruction is particularly powerful for threat hunting: instead of presenting hunters with a flat list of 10,000 raw events, it stitches causally related events into a visual attack chain — process spawned PowerShell, which made a network call, which received an encoded payload, which wrote a file to a temp directory. This compression dramatically reduces the cognitive load of hunting.
Tiered retention — hot (fast query), cold, and archive — matters for Indian enterprises because CERT-In’s 2022 direction on log retention effectively requires organisations to retain certain log categories for 180 days and make them available for incident investigation. PrahiX Ora’s retention architecture is designed to support this requirement without requiring threat hunters to work with slow, expensive archive queries for recent events.
Threat hunting is hindered by topology gaps — segments of the network where you have no visibility. PrahiX Ora’s Network Management System (NMS) provides unified observability across FortiGate firewalls, switches, access points, and WAN/SD-WAN links, using LLDP/CDP topology discovery to automatically map your environment. For large Indian enterprises with multi-vendor estates spanning headquarters, regional offices, and manufacturing sites — where NOC visibility is often fragmented across separate tools per vendor — this unified view eliminates the dark corners where attackers love to operate.
ML-based anomaly detection on network flows flags unusual traffic patterns automatically, surfacing candidates for deeper hunt investigation rather than requiring hunters to know in advance which segments to query.
PrahiX Ora’s video surveillance (VMS) capability supports ONVIF, Hikvision, and Dahua camera management with integrated video analytics. For Indian manufacturing, retail, and multi-site organisations, correlating physical access events — a badge swipe at an off-hours server room entry — with simultaneous network anomalies from the same location gives SOC analysts context that neither physical security nor cyber teams would catch independently. Bringing both under one operations view is especially valuable for sites running 24/7 operations where physical intrusion can directly precede network compromise.
When a threat hunt produces a confirmed finding, the response clock starts. CERT-In’s 2022 directions require organisations to report cybersecurity incidents to CERT-In within six hours of discovery. For large, complex environments, that timeline is genuinely challenging without automation. PrahiX Ora’s SOAR capability addresses this directly: pre-built playbooks with connectors to FortiGate allow automated response actions — pushing attacker IP blocklists to firewall policy, isolating compromised endpoints, disabling compromised accounts — to execute within minutes of hunt confirmation, while simultaneously populating the incident report template with the telemetry collected during the hunt. The automation is what makes the six-hour window achievable in practice rather than a compliance aspiration.
If you want to explore how PrahiX Ora fits your environment, the platform capabilities are documented at ora.prahix.com/platform-capabilities.html.
Threat hunting is not a one-time exercise — it is a continuous programme. Here is a realistic roadmap for Indian enterprises at different maturity levels.
Executive stakeholders and boards need to see threat hunting translated into business risk reduction metrics. Useful KPIs for Indian enterprise CISOs:
Mistake 1: Hunting without sufficient log coverage. A hunt that concludes “no evidence found” is only meaningful if the relevant telemetry was actually available. Always audit log coverage before forming a hypothesis.
Mistake 2: Treating threat hunting as an ad-hoc activity. Occasional unscheduled hunts produce occasional results. A structured calendar with documented methodology produces compounding improvements in detection capability over time.
Mistake 3: Hunting without threat intelligence context. A team hunting generic techniques while a known APT group is actively targeting their sector will find neither. Hunting hypotheses should be driven by current, India-relevant threat intelligence.
Mistake 4: Not closing the loop to detection engineering. If a hunt finds evidence of an attacker technique but no detection rule is written afterwards, the next attacker using the same technique will also go undetected until manually hunted again. Every confirmed finding must produce a detection improvement.
Running a proactive threat hunting programme requires people, process, and platform — and for most Indian enterprises, building all three in-house simultaneously is a multi-year undertaking that competes directly with day-to-day security operations demands.
PJ Networks’ 24/7 NOC/SOC service includes structured threat hunting as part of the managed security offering. Our analysts operate the PrahiX Ora platform across client environments, running monthly hunting cycles anchored to the MITRE ATT&CK framework and updated continuously with CERT-In advisories and sector-specific threat intelligence. When a hunt surfaces a confirmed finding, our SOAR-enabled response capabilities — with direct integration to FortiGate policy management — allow us to contain threats and begin CERT-In report drafting within the regulatory window.
If you are an Indian enterprise CISO looking to assess whether your current detection coverage would catch an advanced attacker already inside your environment — or if you want to understand what a managed threat hunting programme looks like for your sector — we are ready for that conversation.
Contact PJ Networks to discuss how proactive threat hunting, FortiGate telemetry, and the PrahiX Ora SecOps platform can materially reduce your organisation’s breach risk and regulatory exposure under India’s evolving cybersecurity compliance framework.