Situation awareness

As explained in Cyber Threat Hunting

An understanding of relevant environmental conditions, assets, technologies, processes, threats, and adversary activity that supports informed security decisions.

Situation awareness is the operational understanding of an organization’s business, technology environment, processes, security controls, data, and internal and external threats. It supports informed security decisions and makes threat hunts relevant, structured, and effective. section 2.4 section 2.1

Build situation awareness by mapping:

• Business markets, products, services, and the technology services delivered to users. section 2.4
• Systems, applications, operating systems, software, deployment locations, and cloud service models. section 2.4
• Prevention, detection, and response controls, plus the data they generate, where it is stored, and how it is accessed. section 2.4
• Threat actors, tactics and techniques, and previous or current security incidents. section 2.4

Apply this knowledge when creating a threat-hunting hypothesis. Relevance depends on understanding both the threat and its current deployment in the environment; testability depends on available systems, events, data, and tools. Awareness improves as hunts, threat intelligence, applications, and systems provide new information. section 2.2.3

Undetected activity across a network

A red team finds malicious techniques running undetected on Windows 10 machines without antivirus or SOC alerts. The hunter maps user endpoints, an internet gateway, a site-to-site VPN, and cloud-hosted servers, then researches the threat, formalizes a hunt, and searches for similar activity. section 3.1.1

Figure 3.1 High-level network diagram

Use the network diagram to relate endpoints, internet connectivity, VPN access, and cloud-hosted servers before defining hunt scope. section 3.1.1

How Cyber Threat Hunting covers it

How deep it goes

Maps operational context and applies it to hypothesis relevance and testability, stopping short of prescribing a complete inventory method.

Examples

Uses a Windows 10 red-team scenario, endpoint-to-cloud network diagram, VPN gateway, security tools, and hunt hypotheses.

What it assumes

Assumes basic access to organizational context, systems, events, data, and tools while developing environmental and threat knowledge over time.

What you can do after

Apply it to formulate relevant, testable threat-hunting hypotheses and investigate activity using available data and tools.

How it connects

Connects threat hunting, threat intelligence, security controls, security incidents, and detection rules.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• threat actoruses · A threat actor is a person, group, process, or other entity that intentionally attempts to compromise, misuse, disrupt, or defeat the security of a system or information.
• security controlconfigures · A security control is a safeguard, policy, or restriction designed to reduce security risks or enforce security objectives.
• hypothesisproduces · A hypothesis is a provisional proposition, explanation, or prediction that can be evaluated against evidence.
• security trainingproduced by · Security training is structured education that develops people’s knowledge and behaviors for recognizing threats and protecting systems, software, and information.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.