Roles performed within a team
Regardless of a team's size or purpose, each team will have certain roles that must be fulfilled by the members. If the word roles sounds too strict, then let's call them functions instead. Whatever they are called, the ones listed within this book are generic in nature and should be molded as necessary to fit the needs of the team.
The first question that is normally asked by an employer who is managing the resources is this: Do you really need all of those people? The number of resources provided to the team is something that can be debated and can fluctuate with activity. The roles needed are the same if there are 2 or 10 people on the team.
Seven roles will be required throughout the course of the threat hunt, as listed here:
- Team lead
- Host-based analyst
- Network-based analyst
- Threat intelligence (TI) analyst
- Incident responder/security analyst
- Network administrator
- Client system/server administrator ...
