Defining the scope

With the restraints and constraints listed, the idea of the scope of the threat hunt should be clear. The team will need to take the time to formalize and acknowledge, in writing, the proposed scope of the threat hunt. The extra communication will be utilized at each step of the hunt to ensure there's no confusion between the stakeholders and the team. Additionally, this will ensure that any contractual disagreements are rectified early on.

When documenting the scope, it should include a listing of the systems and networks that the team will be hunting on. If the organization says that they would like the team to hunt across their production network, then this network should be, at minimum, listed by name. If there is an enclave that is attached to that network, that enclave could be included by name. This is a great time to begin establishing the collection management framework, as outlined in The hunting cycle section of Chapter 5, Methodologies.

The...