Threat Hunting and Analysis of TTPs

In Chapter 3, the section on detection and analysis covered many possible cybersecurity incident discovery methods. Alerts from security controls, notifications from internal teams on suspicious behavior, and external notifications from subcontractors, counterparties, law enforcement agencies, and cyber threat intelligence cybersecurity vendors still don’t guarantee a holistic defense. Since 2017, the cybersecurity community began a new trend in proactive cyber threat discovery by applying the threat hunting process. Many vendors have tried to scrape this idea by misleading their clients using marketing tricks. It resulted in a lot of companies pulling IoCs from cyber threat intelligence providers, applying them to their security controls such as SIEM, AV, EDR, and Next-Generation Firewalls (NGFW) for retrospective scanning of the collected telemetry and calling it threat hunting.

However, it’s a big misconception. So, what is true...