The US military and government sends their people to classes such as this one: https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hun

The US military and government sends their people to classes such as this one: https://www.sans.org/cyber-security-courses/advanced-incident-response-threat-hunting-training/ https://www.sans.org/cyber-security-courses/advanced-inciden... . The focus is on actively searching for indicators of compromise, vulnerability scanning, and I would imagine network traffic analysis. Based on the US military people I've interviewed and hired, their IT security is very checklist based and I imagine that their "threat hunting" is focused on vulnerability scanners such as Nessus.