liveBook · Manning

TaHiTI

As explained in Cyber Threat Hunting

TaHiTI is an intelligence-driven threat-hunting methodology for proactively searching current and historical IT infrastructure for malicious activity that evaded defenses.

TaHiTI is an intelligence-driven methodology for proactively searching current and historical IT infrastructure for malicious activity that evaded existing defenses. It distinguishes structured threat hunting from investigations that begin only after an event or user report. section 2.7.2

TaHiTI organizes threat hunting into three phases:

  • Initiate: identify the hunt trigger and create and store a basic investigation description. section 2.7.2
  • Hunt: expand the description, create a hypothesis, identify data sources, select analytic techniques, and refine the hunt from execution output. section 2.7.2
  • Finalize: process and document the investigation results. section 2.7.2

How Cyber Threat Hunting covers it

How deep it goes
Defines three phases and details triggers, hypotheses, data sources, analytic techniques, and execution output.
Examples
Uses hunt triggers, investigation descriptions, hypotheses, data sources, analytic techniques, and execution output as process artifacts.
What it assumes
Builds on threat-hunting definitions while distinguishing proactive hunts from post-detection investigation and incident response.
What you can do after
Apply a repeatable workflow to initiate, execute, evaluate, and finalize a proactive threat hunt.
How it connects
Connects threat intelligence, threat hunting, incident response, analytic techniques, and security defenses.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.