  A formal cyber reasoning framework for automating the threat hunting process
is described. The new cyber reasoning methodology introduces an operational
semantics that operates over three subspaces -- knowledge, hypothesis, and
action -- to enable human-machine co-creation of threat hypotheses and
protective recommendations. An implementation of this framework shows that the
approach is practical and can be used to generalize evidence-based
multi-criteria threat investigations.
