CYBER THREAT HUNTING

Set up visibility into the right data:

The first step is to ensure that the threat hunting team has visibility into a wide range of data - network activity, network traffic patterns, system events and logs, etc. Access to this data, along with the relevant context, creates an understanding of what to look for, what data sets to correlate in order to investigate potential threats.

Create a baseline:

We spend time in understanding your business and IT environment to create a baseline for what is normal user behaviour in your organisation. We also gain understanding of what data and information is of value within your organisation. This helps us spot and evaluate outliers from the normal, which could be potential threats.

Create a hypothesis: 

Create different possible hypothetical threat scenarios, detailing an attacker's tactics, techniques and procedures to breach your defenses. We rely on several established attack frameworks, our team’s extensive and in-depth experience, and industry knowledge of the current threat landscape to create detailed and highly contextual hypotheses.

Trigger & Investigation: 

Using the hypothesis as a trigger, our threat hunting team conducts an investigation in a specific area of the organisation. We use various tools and techniques to validate the hypothesis and look for a threat. If we do find evidence of malicious anomalies in a system or network, we dig deeper to uncover the source and the attacker.

Response & Resolution:

The final step of threat hunting is response and resolution. Using the results from the investigation, information security teams can work on responding to and mitigating any threats identified. The data collected from investigations can also be used to improve the technology used to identify threats, reducing overall human interaction, and further automating the process of threat detection.