The Security Operations “Threat Hunting” workspace in FortiAnalyzer 7.4 is explicitly described by Fortinet as “a proactive approach to detecting threats that have evaded existing security controls.” It lets analysts create hypotheses, pivot through log data, and uncover dormant or lateral-movement attacks before they cause harm—thereby enabling proactive network-security management.

A. Incidents dashboards – Summarizes already-detected incidents; reactive after detection, not a proactive search capability.

C. FortiView Monitor – Provides real-time traffic/log visibility but waits for events to occur; chiefly reactive monitoring.

D. Outbreak alert services – Supplies external threat notifications and IOC packages, but analysts must still correlate; not the built-in proactive hunting workflow emphasized by Fortinet documentation.

1. Fortinet. “FortiAnalyzer 7.4.0 Administration Guide

” Section ‘Threat Hunting’

pp. 369-372: “Threat hunting is a proactive

analyst-driven process for identifying hidden threats in your environment.”

2. Fortinet. NSE 5 FortiAnalyzer 7.4 Courseware

Module 4 ‘Security Operations’

slide 28: “Threat Hunting: Provides a proactive methodology… enables analysts to search for threats before alerts are raised.”

3. Fortinet. “FortiAnalyzer 7.4 New Features Guide

” PDF ID FAZ-7.4-NF-2023

p. 11: “The new Threat Hunting workspace empowers security teams with a proactive approach.”