Scenario A – internal threat hunt

The team works through their plan and uses their Cyber Management Framework (CMF) to start collecting data from the network for analysis. Due to the resources provided by Widget Makers Inc., they have decided to collect all the data they can off of any device that the team has access to and comb through it later. If there is a system on the target network that produces logs, they will attempt to obtain those logs for later analysis.

Thankfully, the administrator for the team's equipment really understood what this meant for the data to be hand-processed by a team of relative security novices. They built a SIEM on one of the spare servers. The data from the sensors will import directly into this SIEM after passing through the other detections first. This streamlines the data processing and allows the hunters to get to work faster.

Due to the configuration of the hunters' out-of-band analysis network, the team will gain additional...