Building and Maturing Your Threat Hunting Program

Building an effective threat hunting program can be daunting. This paper addresses how to get started and covers building a team, what a typical hunt might look like and constructing a knowledge base for later use. It also covers how to create a test lab and use effective metrics.

By

June 24, 2019

Login to download

I consent that SANS may provide my contact information to a third-party sponsor of this white paper, and that the sponsor may contact me to describe their goods and services related to this white paper.

By providing this information, you agree to the processing of your personal data by SANS as described in our Privacy Policy.

All papers are copyrighted. No re-posting of papers is permitted

Sponsored By

Related Webcast

Building and Maturing Your Threat Hunt Program

While threat hunting sounds exciting--and promising--building an effective program can be daunting. The very definition of threat hunting is fluid, creating confusion about how to use it. Practitioners often have varying opinions about what would be involved in a threat hunt program and how to use...

Related Content

DFIR - Blog - Enhance your Cyber Threat Intelligence with the Admiralty System_340 x 340(2).jpg

Digital Forensics, Incident Response & Threat Hunting

September 10, 2024

Enhance your Cyber Threat Intelligence with the Admiralty System

The Admiralty System, when adapted for cyber threat intelligence, offers a robust framework for enhancing the reliability of your intelligence.

Freddy Murstad

DFIR blog image.png

Digital Forensics, Incident Response & Threat Hunting

August 22, 2024

A Visual Summary of SANS DFIR Summit 2024

Check out these graphic recordings created in real-time throughout the event for SANS DFIR Summit 2024

Blog: Defending Against Ransomware in ICS

Cybersecurity Insights, Digital Forensics, Incident Response & Threat Hunting, Industrial Control Systems Security

August 30, 2023

Defending Against Ransomware in Industrial Control Systems

Leveraging ICS612 and the SANS Five Critical Cybersecurity Controls