The success of threat hunting programs is rooted in data. Organizations need to have tools in place to collect data from systems, because this information provides valuable clues. Human threat hunters are used to complement automated systems, because they bring a different perspective and are able to see things that machines cannot.
Threat hunters go beyond automated detection systems, such as security information and event management (SIEM) and endpoint detection and response (EDR). They identify patterns of suspicious activity that a computer might have missed or judged to be resolved was not. In addition, when a threat hunter finds issues, they can handle remediation.
Four key steps in threat hunting are:
Data collection—using automated systems to cull vast amounts of information and surface anomalies that could be the sign of nefarious activity
Investigation—leveraging automation to reduce the threat noise by quickly categorizing which threats are high, medium, and low risk
Prevention—mitigating risk by implementing systems to deter known threats
Response—containing and neutralizing threats using automation where possible