Building a threat hunting practice – roles and skills
Throughout this chapter, we have mentioned that threat hunting is a manual process that can be partially automated, but the final verdict still rests on human shoulders. AI is a powerful tool that can help reduce the workload of the specialist, but it doesn’t relieve them of responsibility for the final decision.
The necessary skillset required for the threat hunting practice is as follows:
- Incident Response (IR)
- Malware Analysis (MA)
- Cyber Threat Intelligence (CTI) consumption
- Log Analysis (Logs)
- Digital Forensics (DF)
At the Australian Cyber Conference 2023, Roman Rezvukhin presented a methodology for evaluating threat-hunting team skillsets, the minimum required knowledge for each phase of the threat-hunting process, and a way to visualize the skills gaps. Every hunter should be empirically evaluated or evaluate themselves with a score from 0 to 5, mostly determined by their overall...
