The importance of automation

When talking about threat hunting, keep in mind that it cannot be fully automated. Threat hunting is a hugely creative process that requires a deep understanding of the environment and how the adversaries operate. Part of the hunter's goals is to come up with detections that can be automated, but the discipline itself is a combination of human intelligence, processes, technology, and automation itself. The hunter needs to find what the machine can't, but they don't have to repeat the same hunts over and over. That's where automation and big data processes play a crucial part.

The hardest part about threat hunting is that you can never be sure whether you have succeeded; that is, unless you go deep enough into the threat hunting rabbit hole as to prove that there actually isn't any malicious activity in your organization's environment, if you have proved that there are no false negatives. The only thing you can do is minimize...