LevelBlue Threat Hunters Earn Top Global Rankings in SentinelOne Competition

Three LevelBlue security experts put their investigative skills to the test in the SentinelOne Threat Hunting competition, with Jodie McDonald earning the top spot in EMEA and advancing to the Grand Final at OneCon.

Threat hunting requires more than knowing your way around a security platform. It takes curiosity, analytical thinking, and the discipline to follow the evidence, even when it leads somewhere unexpected.

Three LevelBlue security experts recently demonstrated those skills on a global stage, earning standout results in the SentinelOne Threat Hunting competition. Jodie McDonald, Senior DFIR Consultant, finished No. 1 in EMEA, securing her place in the Grand Final against the top competitors from the Americas and Asia. Rishi Aggarwal, Senior Security Solutions Architect, ranked in the top 15 in the Asia Regional Final, while Eni Zeqo, Senior DFIR Consultant, placed among the top 25 competitors in EMEA.

The competition challenged participants to investigate alerts, logs, and evidence across four areas: Endpoint, Cloud, Data & AI, and Securing AI. Working against the clock, competitors had to uncover the story behind the data, distinguish meaningful signals from noise, and deliver accurate answers under pressure.

For the LevelBlue team, the experience was an opportunity to test their skills, explore evolving security technologies, and put their real-world investigative experience to work in unfamiliar scenarios.

Following the evidence, not just the alerts

For digital forensics and incident response (DFIR) professionals, an alert is only the beginning of an investigation. Understanding what happened, how it happened, and what else might be affected requires looking beyond the initial signal.

That mindset was central to how all three competitors approached the challenge.

“When faced with large volumes of alerts, I would typically first try and categorize by alert type to determine the most high fidelity alerts,” McDonald explained. “Then, further down the line with the context I have gained from the higher fidelity alerts, I would look at the alerts such as lateral movement, and do queries around that to gain full understanding of threat actor activities.”

Zeqo emphasized the importance of prioritization, particularly when investigating a potentially active incident.

“It is important, just as it was in the competition, that we provide precise answers within the shortest window of time possible to reduce the risk of the incident spreading further if we are dealing with a live threat.”

For Aggarwal, building a reliable timeline is essential to separating meaningful evidence from an isolated alert.

“I normally start with the things I can trust, such as timestamps, identities, devices, process activity and network connections. I build a quick timeline and look for one or two strong anchors,” he said. “The trail worth following is usually the one that explains several pieces of evidence, rather than simply the alert that looks the most serious at first.”

Although their professional backgrounds differ, the three approaches share a common principle: effective threat hunting means connecting the dots rather than stopping at the first plausible explanation.

Curiosity is what separates a good threat hunter from a great one

Technical expertise provides the foundation for threat hunting, but the ability to question assumptions and investigate beyond the obvious is what turns individual findings into a fuller understanding of an incident.

“I would say being curious,” McDonald said when asked what separates an excellent threat hunter from someone who simply knows the technology. “Seeing an alert and knowing what it means is good, and gives a finding, but the natural curiosity to want to dig deeper makes for a richer finding.”

That curiosity can mean investigating how a suspicious executable arrived on a system, what happened before and after an alert, or whether the same activity appears elsewhere in an environment.

Aggarwal described the same instinct as a combination of curiosity and discipline.

“Curiosity, discipline and a willingness to be wrong. Knowing the technology is important, but a good threat hunter also questions their first assumption, follows the evidence and can explain why a conclusion makes sense.”

It is a particularly important skill in a competition environment, where participants have limited time to investigate each scenario. This year's challenge gave competitors just 30 minutes to answer eight questions in a round.

McDonald and Zeqo both found that knowing when to move on was just as important as knowing when to dig deeper. If an answer did not emerge after a few minutes, they would switch to another question and return later if time allowed.

For Aggarwal, the decision came down to whether an investigative path was producing useful evidence.

“If a few pivots did not produce anything useful, I parked that hypothesis and tested another one,” he explained. “That did not mean the original idea was necessarily wrong. It just meant it was not producing enough evidence to justify spending more time on it at that point.”

That balance between persistence and adaptability is essential in a timed challenge and in real-world investigations where thoroughness and speed can both have significant consequences.

Putting security technology to the test

The competition also gave participants an opportunity to explore SentinelOne capabilities beyond their usual workflows, including Purple AI, which can help analysts formulate queries and identify investigative leads.

McDonald and Zeqo both use Purple AI to develop queries that support threat hunting, while emphasizing the importance of validating results and understanding the underlying data.

“Whilst Purple AI then returns the results, for myself I typically will then go and run that query myself, as I am mindful that sometimes AI can be wrong, and it’s important in an investigation to know that the data returned is completely accurate,” McDonald said.

Aggarwal took a similar approach, using AI to accelerate his initial investigation without handing over the responsibility for the final conclusion.

“I used Purple AI to help me get oriented, phrase questions and identify possible pivots more quickly. I treated its responses as leads rather than final answers. Any conclusion still had to match the underlying telemetry and timeline.”

The competition also pushed the participants into less familiar territory. McDonald and Aggarwal identified Securing AI as their biggest stretch, while Zeqo found Cloud more challenging because she had fewer opportunities to explore that area in her day-to-day work.

Those unfamiliar scenarios made the experience particularly valuable. As McDonald put it, the competition offers a chance to test emerging features before encountering them in a real client investigation.

“I think just how fun it is and how much you can learn! SentinelOne, and other platforms for threat hunting competitions, are always adding new features that we may not have an opportunity to experience in the wild.”

For security professionals, that combination of practical experience and experimentation helps build familiarity with new capabilities before they may be needed in a live investigation.

Three standout achievements

Each LevelBlue competitor brought a different set of experiences to the challenge and each came away with a result worth celebrating.

Jodie McDonald: No. 1 in EMEA

McDonald’s path to the top spot came with an unexpected twist. She initially believed she had finished third in the EMEA Regional Final. Later that evening, emails from SentinelOne suggested otherwise. The following morning, she learned that two competitors ranked above her had been disqualified for cheating, confirming her first-place finish.

“At first I couldn’t believe it, since I thought I had come third, so it did take me a little bit to process that actually I had won it!”

Now, McDonald is preparing to represent EMEA in the Grand Final at OneCon, where she will compete against the top-ranked hunters from the Americas and Asia.

Her strategy is to rely on the same methodical approach that brought her through the earlier rounds and not let the clock dictate her investigation.

“As hard as it is, I try to pretend like the clock isn’t there, and try to treat it like I am doing an actual DFIR investigation.”

Rather than focusing solely on the question in front of her, she aims to follow natural investigative paths, collect useful context, and recognize that an answer to one question may emerge while investigating another.

Rishi Aggarwal: A top-15 Asia Regional Finalist

Aggarwal ranked among the top 15 competitors in Asia and highlighted his ability to adapt across all four competition areas. With only a few months of SentinelOne experience, he also finished first in three qualifier games, earned three trophies, and ranked first in the combined Asia qualifier standings, according to his competition results.

“I’m most proud of adapting quickly and staying competitive across four very different areas,” he said. “The experience also gave me a much better understanding of how my existing SIEM and investigation skills could transfer into SentinelOne.”

Aggarwal also acknowledged Grant Hutchons, LevelBlue Director of Security Solutions Engineering for APAC, for introducing him to SentinelOne and encouraging him to participate, as well as the support he received from Grant and LevelBlue throughout the experience.

Eni Zeqo: A top-25 EMEA competitor

Zeqo finished among the top 25 competitors in EMEA, drawing on her DFIR experience and the knowledge she gained working closely with LevelBlue's Threat Monitoring and Containment (TMAC) team.

“I am proud to have been able to compete alongside peers in the industry with such vast knowledge and still place relatively high in the leaderboards,” she said.

She credits her experience working with the TMAC team for helping her learn how to navigate endpoint detection and response platforms, particularly SentinelOne, and apply those skills in the competition.

Her results reflect both the value of hands-on investigative experience and the importance of continually learning from colleagues and new challenges.

Together, these achievements demonstrate the depth of investigative talent across LevelBlue and the value of bringing different technical backgrounds and perspectives to complex security challenges.

Next stop: OneCon

With the Grand Final approaching, McDonald has one more challenge ahead: competing against the top threat hunters from across the Americas, EMEA, and Asia.

Her preparation comes down to staying calm, trusting her investigative instincts, and remembering that the answer is not always immediately apparent.

“There were many questions within the qualifiers and EMEA final where I found the answer later on whilst working on another question and not even looking for the answer to the original question,” she said. “I think just keeping in mind that I may find the answers whilst working on another question and to not stress!”

It is advice that applies well beyond a competition. Effective threat hunting depends on staying curious, questioning assumptions, and allowing the evidence to tell the story.

Congratulations to Jodie, Rishi, and Eni on their impressive performances. As Jodie heads to OneCon to compete for the global title, the LevelBlue team will be cheering her on. Good luck, Jodie!