Instead of waiting for an alert, a hunter starts with a question or hypothesis, for example that an attacker is using a particular technique, and searches logs, endpoint data and network records for traces. The MITRE ATT&CK framework is often used to choose which techniques to look for.
Hunting finds what automated tools miss, particularly attackers who use normal tools and valid accounts. It is also a good way to test whether your logging is good enough. If you cannot answer a hunting question, you have found a gap.
A typical hunt after a web server flaw is made public looks for unexpected new files in web directories, unusual child processes of the web server and outbound connections from servers that rarely make them.
Write down each hunt, including the question, the data used and the result, turn useful hunts into permanent detections and make sure logs are kept long enough to search back.