The purpose of this paper is to introduce an effective framework and methodology to threat hunting that enables SecOps teams to plan and conduct hunts that maximize the opportunity to successfully find and disrupt attacks in progress. The paper also demonstrates the importance of
data analytics to threat hunting, and shows how SecOps teams can leverage Kibana — a widely used data analysis and data visualization tool — to dramatically improve their threat hunting capabilities. Finally, using a real world example of an advanced persistent threat, the paper demonstrates how to apply the hypothesis-based methodology to hunt down and stop an attack in progress.

Request Free!