Chapter 10: Leveraging Hunting to Inform Operations
In the previous few chapters, we have focused in-depth on leveraging the Elastic Stack to perform hunt operations. This was done by searching through your data using the Discover App, creating rich and contextual visualizations and dashboards, and leveraging the Security App to explore malicious endpoint and network activities.
A key aspect of the success of hunt operations is how they are incorporated into traditional security and IT operations. Let's now explore how to enhance the protective posture of organizations. In this chapter, you'll learn about the incident response process, how threat hunters can fold into that process, how threat hunters can do more than just find adversaries, and finally, some useful third-party sources to help keep your skills sharp.
In this chapter, we're going to cover the following main topics:
- An overview of the incident response process
- Using threat hunting information...
