Gamification through threat hunt packs and/or threat hunting functions

Abstract

A non-transitory storage medium includes logic associated with a cybersecurity threat hunting system. Upon execution, the logic analyzes input event data to detect whether the input event data constitutes a cyberthreat. The logic includes a function evaluator, which is configured to extract features from the input event data that is relevant, based on experiential knowledge or past analyses, for use in determining whether one or more cyberthreats are associated with the input event data. The function evaluator includes one or more hunt packs, each of the one or more hunt packs includes one or more hunting functions, and each hunting function of the one or more hunting functions is configured to analyze the input event data received from at least one cybersecurity source.