So You Want to Build a Threat Hunt Program
summary
Defines threat hunting as human-driven, proactive, iterative work and gives a starter program: choose unstructured ad hoc hunts or a structured, ticketed team; focus detections above simple hashes on the upper half of the pyramid of pain (network/host artifacts and TTPs); follow four phases — pre-hunt • hunt • post-hunt • reporting — with documented hypotheses, gap analysis, lessons learned, and content handoff to SIG/SOC teams. Recommends central log storage, EDR/SIEM data, a ticket system, chat, a maturity matrix (people/process/tech), and that one curious person doing hours daily is worthwhile.
AI-written summary · about
chapters (10)
- 0:00Start
- 6:30build a definition a mission statement
- 16:49reportings up the rest of the chain
- 20:19focus more so at the top half of the pyramid
- 23:12break down threat hunting really into four main phases
- 23:38established a way of gathering the resources
- 26:42creating an executive summary and giving that over to your executive leadership
- 28:38trying to attack the behavior of an adversary versus their tools
- 30:18raise tickets to the appropriate teams
- 32:35implement some form of threat hunting into their business strategy
related talks
31mThreat Hunting — Demystified
34mFormulating An Intelligence-Driven Threat Hunting Methodology
42mPractical Threat Hunting: Straight Facts and Substantial Impacts
40mHunt and Gather: Developing Effective Threat Hunting Techniques
50mI Screwed Up Threat Hunting a Decade Ago and Now We're Fixing it With PEAK
48mPractical Learnings for Threat Hunting and Improving Your Security Posture
44mNetwork Based Threat Hunting: Lessons Learned, Techniques to Share
38mHow I Learned to Stop Worrying and Build a Modern Detection & Response Program