Correlating events and alerts for threat hunting purposes

Your main tool for threat hunting exercises should be some form of event correlation solution. We want a convenient way to find anomalies and correlate/compare those anomalies on a larger scale, to see if we can find additional clues as to what we are looking for. An existing SIEM solution normally lends itself well for the purpose of threat hunting. Note, though, that we will be using the SIEM as a lookup and correlation method to find threats; we won't be relying on the detection mechanisms built into a SIEM to tell us where these threats are. This would just be an automated alert and not a threat hunting exercise. An SIEM alert may trigger a threat hunting exercise, as we discussed earlier, but an SIEM is not a threat hunting resource by itself.

In the previous chapter, Chapter 9, Visualizing, Correlating, and Alerting, we looked at, installed, configured, and worked with a fantastic event and alert management and...