The Proactive Side of Threat Hunting

So maybe that's a good chance for you guys to talk about what you do on the proactive side kind of within managed offense. Obviously you are responding to alerts within customer environments correct but you're also doing some proactive work as well. And what are some of the things that our inputs into that proactive hunting process? I mean you mentioned working off of the MITRE ATTACK framework but I imagine you're also getting inputs from you know maybe a new technique that the IR guys are seeing or something that AP has been able to attribute.