Threat Hunting Use Case: Web Proxy

This report is a ReliaQuest threat-hunting use case for Web Proxy logs: it defines the objective (baseline web traffic to identify anomalies), required log sources (forward proxy logs), a 7-day duration, and related MITRE techniques. The guidance enumerates baseline/hygiene checks and threat analysis hunts — including review of uncommon user-agents, blocked traffic to risky categories, direct IP requests, POST/PUT to cloud storage or paste sites for exfiltration, risky file extensions, phishing link patterns, and IOC lookups — and recommends using ReliaQuest GreyMatter to aggregate and analyze telemetry.