Threat hunting is an approach for search out, identifying, and understanding APTs. Threat hunting, like any methodological information security mission, is not about tools and utilities. It is a combination of processes, people, and technology.
Threat hunting involves the following steps:
- Creating hypotheses
- Investigating by using tools and techniques
- Uncovering new patterns
- Informing and enriching analytics
The following steps form the threat-hunting loop:
You can evaluate the maturity of your threat-hunting program by selecting a level from the following:
- Level 1: Initial (little or no data collection, relying on automated alerts)
- Level 2: Minimal (high level of data collection)
- Level 3: Procedural (high level of data collection, following data analysis procedures)
- Level 4: Innovative (high level of data collection, following new data analysis...
