The platform owner refuses your 12-month LSASS sweep on compute cost — how do you still run the hunt?

## Why the full window is worth wanting A hunt is retrospective by nature. Its value is a statement about a *period*: this behaviour did or did not appear across the estate over some span of time. Intrusions are routinely discovered long after initial access, and the procedure you are sweeping for may have run months before anyone wrote a rule for it. A seven-day sweep answers a question nobody needed asked; the whole reason to reach for the full searchable window is to make a claim that covers the time an intruder could plausibly have been present. That is also exactly why it is expensive. Sweeping every process-access record on a large fleet for a year is one of the heaviest things a hunter can ask a search platform to do, and the platform owner refusing is a legitimate act of stewardship, not obstruction. ## Engineer the sweep down before you negotiate Most of the cost is usually self-inflicted, so exhaust that first. - **Sample and extrapolate.** Run the sweep over a few days on a slice of hosts. That gives you the hit density, the scan volume and the wall time, and turns "I need twelve months" into "twelve months costs roughly this much and, at the observed hit rate, will surface roughly this many rows for review". Nobody can negotiate against a request with no number in it. - **One variant at a time.** The technique expands into several procedures; each has its own query and its own cost. Running them as separate jobs spreads load, produces partial results early, and lets you stop when one of them finds something. - **Cheapest predicate first.** Filter on the narrow, indexed thing — the target image and the memory-read bit in the access mask — and exclude the small set of known-good source images *inside* the query, before applying anything expensive such as call-stack pattern matching. The ordering can change the cost by an order of magnitude. - **Project, do not export.** Ask for the five fields the analysis needs, not whole records. - **Chunk and schedule.** Split the window into slices run off-peak. The same total work spread across nights is a very different proposition for a shared cluster than one query at 10:00 on a weekday. - **Move the data once.** If the platform genuinely cannot support the scan, a single narrow extraction into somewhere cheap, analysed offline, is sometimes the pragmatic answer — with the obvious care about where a copy of that data now lives. ## Then trade window against variant What survives is a real trade, and the right shape is usually asymmetric. Variants with a low base rate — an unusual source image, an unbacked call stack, a driver load on a workstation fleet — are cheap per unit of window, so buy them the full twelve months. The broad variant that matches every management agent in the estate is expensive and low-yield per row, so buy it thirty days and say so. ## The decision that is not yours The scoping is your job. Accepting the residual is not. If the affordable sweep covers thirty days, then the organisation has an unexamined eleven months for that technique, and someone with a risk mandate — not the person who owns the search cluster — decides whether that is acceptable. Your obligation is to put the choice in front of them in the terms they can act on: what the sweep would cost, what claim each budget buys, and what remains unknown at each price point. This is also where precision of language matters most. "We hunted for credential dumping and found nothing" is heard as a clean bill of health for the enterprise. "Across thirty days of process-access records, on the ninety-four percent of hosts reporting, the five procedures on our list produced no unexplained hits; the preceding eleven months were not searched" is a sentence a decision can be built on. Never let the first version be the one that reaches an executive summary. ## Make the next negotiation shorter Instrument the hunt itself. Record scanned volume, wall time, rows returned, rows reviewed and the verdicts they produced. Over a handful of hunts that gives you a cost-per-hunt figure with outcomes attached — including outcomes that are not intrusions, such as a discovered telemetry gap, an unmanaged host or a misconfigured agent, which are real findings that the platform owner's own team usually cares about. A standing, predictable compute allocation for hunting is far easier to win with that history than by arriving with a large one-off request each quarter. And when the platform owner sees findings that improve their estate coming out of the spend, the negotiation stops being adversarial.