liveBook · Manning

Cyber threat hunting capability

As explained in Cyber Threat Hunting

A cyber threat hunting capability is an organizational capacity to proactively search for malicious activity that evaded existing security controls.

A cyber threat hunting capability is an organizational capacity to proactively search systems, networks, and infrastructure for malicious activity that evaded existing security controls. It provides active defense by seeking advanced threats and disrupting adversaries early in the attack sequence. section 2.7.2

A functioning capability is directed toward four operational outcomes:

  • Search for indicators of compromise across organizational environments. section 2.7.2
  • Detect threats that bypass firewalls, intrusion prevention, sandboxes, or SIEM technologies. section 2.7.2
  • Track adversaries as early as possible in the attack sequence. section 2.7.2
  • Disrupt threats while improving response speed and accuracy. section 2.7.2

How Cyber Threat Hunting covers it

How deep it goes
Defines targets and outcomes but stops short of specifying hunting procedures, tools, or investigation workflows.
Examples
Uses organizational systems, networks, infrastructure, and indicators of compromise as hunting targets.
What you can do after
Operate a capability that searches for, detects, tracks, and disrupts threats missed by existing controls.
How it connects
Connects active cyber defense with security controls, indicators of compromise, risk assessment, and incident response.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.