Generating Hypotheses for Successful Threat Hunting

Generating Hypotheses for Successful Threat Hunting (PDF, 2.65MB)Published: 15 Aug, 2016

Created by:

, Robert M. Lee & David Bianco

Threat hunting is a proactive and iterative approach to detecting threats. Although threat hunters should rely heavily on automation and machine assistance, the process itself cannot be fully automated. One of the human's key contributions to a hunt is the formulation of a hypotheses to guide the hunt. This paper explores three types of hypotheses and outlines how and when to formulate each of them.

Meet the experts

Robert M. Lee

Fellow

A former U.S. Air Force cyber warfare officer, Robert led the NSA’s first mission targeting threats to industrial infrastructure. Now at Dragos, he spearheads global defense of critical systems, shaping national policy and industry threat response.

Learn more

David Bianco

Certified Instructor

David has 20+ years of experience in the information security field, primarily in incident detection and response, threat hunting, and Cyber Threat Intelligence. He is the creator the Pyramid of Pain and the Threat Hunting Maturity Model.

Learn more