Intelligence-Driven Incident Response, 2nd Edition

Chapter 4. Find

Be very, very quiet; we are hunting wabbits.

Elmer J. Fudd

The first half of the F3EAD cycle contains the primary operational components—Find, Fix, and Finish. Operations in this context means a planned, coordinated action in response to a developing situation. For us, this means incident-response operations for unauthorized network activity. During these first three phases, the adversaries are targeted, identified, and eradicated. We use intelligence to inform these operational actions, but that’s not the only use of intelligence. Later in the process, the data from the operational phases will feed into the second half of F3EAD, which contains the intelligence-focused phases—Exploit, Analyze, and Disseminate.

This chapter focuses on the Find phase, which is the starting point for both intelligence and operational activities. In the traditional F3EAD cycle, the Find phase starts when the operations team identifies high-value entities to be targeted. In intelligence-driven incident response, the Find phase identifies relevant adversaries for incident response.

In the case of an ongoing incident, you may have identified or been given some initial indicators and need to dig for more, or in the case of threat hunting, you may be searching for anomalous activity in your networks. Regardless of the situation, before you can find anything, you need to have an idea of what it is you are looking for.

Various approaches can be taken in the Find phase. The method you take ...