Summary

This chapter explained the industry gold standard of the threat-hunting process and its impact on the organization’s overall cybersecurity posture. The scope of a proactive threat-hunting process was examined, from the day-to-day painstaking work of identifying intrusions missed by defenses from the most sophisticated attack groups to the post-incident monitoring of intrusion-related activity. We also described all the pitfalls that can be encountered in the preparation phase of proactive threat hunting – gathering cyber threat intelligence, converting this data into one-time and continuous hunting queries, preparing the necessary data sources, running queries on the EDR or SIEM solutions, analyzing the results and detecting anomalies, combining four different data analysis approaches, and triggering incident response process.

Lastly, five core areas of knowledge required for threat hunters were discussed, including their minimum required levels. The key takeaway...