The Threat Hunting Process

There are several Security Information and Event Management (SIEM) solutions to choose form and several articles have been written about how they work and how to choose the one that better suit your organization needs. Further ahead in this book we are going to use some open source solutions developed using the Elastic SIEM. You should use this type of solution to centralize all the collected logs from your systems to help you analyze the data. It is important to assure the quality of the data collected. Low quality data would rarely lead to successful hunts.

Another good starting point is to search for published hunting procedures that you could incorporate into your own processes. You can also create new hunting procedures having the needs and concerns of your organization in mind. For example, you can create hunting processes focus on specific threat actors with proven interest on your organization´s industry. Document and automate as much as possible...