Mastering Machine Learning for Penetration Testing

Threat-hunting methodology

Threat hunting is an approach for search out, identifying, and understanding APTs. Threat hunting, like any methodological information security mission, is not about tools and utilities. It is a combination of processes, people, and technology.

Threat hunting involves the following steps:

• Creating hypotheses
• Investigating by using tools and techniques
• Uncovering new patterns
• Informing and enriching analytics

The following steps form the threat-hunting loop:

You can evaluate the maturity of your threat-hunting program by selecting a level from the following:

• Level 1: Initial (little or no data collection, relying ...