The process begins with the creation of hypothetical attack scenarios or the identification of abnormal network activities. These hypothetical attack scenarios are tested through a data collection process that involves collecting network logs and endpoint logs to hunt for threats.
The hypotheses are then tested using various tools and techniques to discover malicious pattern and adversaries TTPs.Threat hunting is predominantly a human-driven activity where cybersecurity analysts leverage their expertise, along with machine learning and user and entity behavior analytics (UEBA) tools, to analyze and search collected data for potential risks. It is essential to understand how the threat hunting process works.
The threat hunting process involves: