Scenario B – external threat hunt

CSI continues to hunt and prove the majority of their hypotheses. The ones that aren't proven are either modified so that they align with the new data the hunt has produced or are removed to determine how the incorrect and non-modifiable hypothesis was produced. As part of the initial agreement, and the standard for all CSI engagements, a threat intelligence brief, leadership, and technical report must be developed.

The threat intelligence brief is culled from all the intelligence that was produced during the threat hunt. It is carefully edited to remove any loss of intelligence gathering abilities for CSI in the future. The report is not a standard work document. Many graphics must go into the report to detail how this organization's threat profile from the darknet compares to organizations in the same business. Some of the findings point out that they're not doing as well as their peers in controlling data, credentials, and...