Hunting starts with a question, not a dashboard
A hunt begins with a specific idea about what an attacker might be doing, not with browsing data hoping something stands out.
Staring at dashboards feels productive and finds very little, because you are relying on something unusual being visually obvious. A hypothesis narrows the search to somewhere an answer would actually appear, and produces a conclusion either way, which browsing never does.
More on Threat hunting
- Absence of evidence depends on coverageOnly the lit part was searched
- Hunts can become future detectionsLeave a bell on the path
- Threat intelligence should change a question or actionDid it move the points? Intelligence is useful when it changes what you ask or what you do
- Entity context turns events into investigationsThread the beads
- Baseline means understanding normal variationNormal is a band, not a line
- Hunt scope should be explicitPeg out the ground first