CompTIA CySA+ Cybersecurity Analyst Certification All-in-One Exam Guide, Second Edition (Exam CS0-002), 2nd Edition

CHAPTER 13

The Importance of Proactive Threat Hunting

In this chapter you will learn:

•   The key benefits of creating a threat-hunting capability

•   The process for threat hunting

•   Tactics for threat hunting

•   How to integrate threat hunting results into other security operations

A hunt based only on trophies taken falls far short of what the ultimate goal should be.

—Fred Bear

The majority of security concepts we cover in this book are reactive. Whether they involve tuning endpoint detection tools to identify potential incidents or blocking traffic based on how it is attempting to traverse the network, these techniques rely on your being able to observe behavior and make a call on whether it is good or bad—as it is happening or shortly ...