Scenario A – internal threat hunt

The team gets their war room ready using laptops and the servers that were previously decided upon. The team uses the network diagrams previously provided to determine the best location for sensors to gather interesting network data. First, they identify the enclaves they want to capture from, and then where the sensor would make the most sense, not just logically to ensure all traffic is captured, but physically as well. The sensors need to be placed in a location with adequate cooling and power, the same as any other IT device.

Once the sensor plan is determined, it is submitted to the stakeholders to determine whether there are any issues. Because of the legwork done by the legal team early in the hunt planning, there are no issues with the sensors being placed for the government-connected networks. However, the company is not willing to allow the hunt team to connect directly to the network and will be using out-of-band connections with...