Threat-hunting framework

As explained in Cyber Threat Hunting

A threat-hunting framework is a structured set of practices, processes, and guidance for organizing and managing threat hunting.

A threat-hunting framework organizes the practices, processes, roles, resources, systems, triggers, and outcomes needed to manage structured, hypothesis-driven hunts rather than only alert-driven investigations. section 2.0 section 2.7.1

A practical framework defines:

• Process phases: preparation, execution, and communication. section 2.7.1
• Roles: threat-intelligence analyst, threat hunter, incident response team, and platform engineer. section 2.7.1
• Resources and systems for hunt plays, reporting, event correlation, endpoint queries, network flows, packet capture, sandboxing, intelligence, and case management. section 2.7.1
• Triggers such as threat intelligence, threat modeling, red or purple team exercises, and lessons from past incidents. section 2.7.1
• Exit criteria for unavailable data, a proven hypothesis requiring incident response, or a hunt that finds no threat. section 2.7.1

Hypothesis-driven hunt

A hunt begins with a what-if question and an initial lead or clue. The hunter prepares the investigation, executes queries and other checks, optimizes the hunt, communicates results, and hands a proven incident to incident response. section 2.7.1

Figure 2.6 High-level threat-hunting process

Use the high-level process figure to navigate the relationship between preparation, execution, and communication. section 2.7.1

How Cyber Threat Hunting covers it

How deep it goes

Defines phases, roles, resources, tools, triggers, and outcomes, while stopping short of detailed hunt-specific procedures.

Examples

Uses preparation, execution, and communication phases; hunt plays; reports; queries; event searches; network flows; and packet capture.

What it assumes

Assumes foundational threat-hunting concepts while establishing the practice structure, responsibilities, processes, and data sources.

What you can do after

Operate structured hunts, coordinate participants, document investigations, and escalate proven hypotheses to incident response.

How it connects

Connects threat intelligence, threat modeling, incident response, data sources, MITRE ATT&CK, and NIST Special Publication 800-53.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• threat huntinghas part · Threat hunting is the proactive investigation of systems and networks to discover malicious activity that automated detection may have missed.
• threat-hunting playconfigures · A repeatable operational procedure for conducting a particular threat hunt and recording its investigative scope and logic.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.