The Foundations of Threat Hunting

Chapter 9: Hardware and Toolsets

In Chapter 7, Planning, the process of identifying resource requirements for the threat hunt was discussed. This chapter goes over the planning for resources in greater detail. The first item that the team must identify is the type of target networks and technologies that they will be interfacing with. This determination will aid them in identifying the personnel and equipment required to conduct the hunt.

Every hunt can and should be customized to the target network. This could include going so far as to establish a dedicated private cloud that a sensor can use a VPN to connect through for the team to be able to export outside the organization's, or a possible threat actor's, direct observation. While this book ...