Scenario B – external threat hunt
CSI has a subcontract with an intelligence firm called IntelAllSense Inc. Throughout the hunt, the team lead works with stakeholders, hypothesis development, and data source determination until they've built a portfolio of items for the contractors to check on. They pass the company's domains, external IP addresses, the enterprise's global address list, and selected social media profiles from critical workers.
IntelAllSense has access to long-running personas on the darknet that threat actors trust. This access is in many extortion, fraud, and hacking sales forums and Telegram groups. They also have access to aggregation tools and network monitoring tools that are automatically enriched with intelligence data by the tool developers. These tools are very expensive, but because IntelAllSense sells these services, the costs are spread among client contracts, which makes it possible for smaller firms such as CSI to use them.
...
