Threat intelligence should change a question or action
The test for intelligence is whether anybody did anything differently.
Blocked something, hunted for something, reprioritised something, asked a question they would not otherwise have asked. If a feed arrives, gets ingested and changes nothing, it is a cost rather than a capability however good the underlying research is. This is worth asking about quarterly, because the answer drifts.
More on Threat hunting
- Hunting starts with a question, not a dashboardBring a question
- Absence of evidence depends on coverageOnly the lit part was searched
- Hunts can become future detectionsLeave a bell on the path
- Entity context turns events into investigationsThread the beads
- Baseline means understanding normal variationNormal is a band, not a line
- Hunt scope should be explicitPeg out the ground first