Restraints and constraints
Before attempting to identify team constructs and the equipment that they will need, the listing of restraints, constraints, and then assumptions needs to start.
Moving on to the threat hunt, the team should already have a listing of actions or events that they do not want to occur. All these items are restraints since the team is forcing itself into not doing something. Restraints aren't immutable; the team can change them as needed. Some common examples are listed as follows:
- An external threat hunt team will hand off any legal activity to local defenders if law enforcement is involved in the target enterprise.
- The team will not provide definitive intention or association for any activity that occurs on the enterprise.
- The team will not provide unsanitized examples or reports from previous threat hunts.
- The customer organization is responsible for any new configurations and the implementation of defensive actions within the...
