OVERVIEW
Threat hunting services combine knowledge, intuition, and automation to proactively search for covert signs of an active or attempted compromise. Obrela’s Threat Hunting Framework leverages advanced analytics and threat intelligence to investigate and mitigate malicious activities within our clients’ digital universe. The team performs active threat hunting cycles in order to:
- uncover potential hidden threat actors and minimize the attack impact
- identify gaps in the monitoring visibility within the organization
- identify previously unknown attack surfaces
- further fine-tune security analytics content.
Threat Hunting Teams and Blue Teams are closely integrated with the mainstream security operations exchanging valuable intelligence to enhance visibility and readiness.
Based on experience in the front line of incident response, Obrela’s Threat Hunting framework focuses on proactive hypothesis-driven threat profiling and covers two functional streams of work:
- Systemic based. Threat hunting also executes threat hunting cycles to systemically uncover and identify malicious activity or emerging IOCs that are in progress.
- Mission Based. In mission-based threat hunting is actively engaged to “lock” attack behavior and malicious activity that has been reported from threat intelligence or the security operations.
In both streams the focus is Data collection and analysis; false positives elimination is crucial in this step until the hunter reaches to the point that only findings that need to be further investigated exist.
MAIN STREAMS OF WORK
Threat hunters continuously collect and analyze threat intelligence from various sources, including open-source intelligence (OSINT), industry feeds, dark web monitoring, and internal security data. This stream of work involves staying updated on the latest threat actors, attack techniques, vulnerabilities, and indicators of compromise (IOCs).
Threat hunters formulate hypotheses based on threat intelligence and known patterns of attack. These hypotheses guide the hunting process, allowing hunters to focus on specific areas, systems, or behaviors that may indicate the presence of a threat. Hypotheses are developed through a combination of threat intelligence analysis, system logs analysis, and understanding of the organization’s assets and infrastructure.
Threat hunters gather relevant data from various sources such as logs, network traffic, system artifacts, and security tools. This includes conducting in-depth analysis of network traffic, log files, endpoint telemetry, and other relevant data to identify anomalous activities, potential IOCs, and signs of compromise. Advanced analytics and machine learning techniques are often employed to identify patterns, anomalies, and potential threats.
When threats or indicators of compromise are discovered, threat hunters collaborate closely with incident response teams to initiate rapid response and containment actions. They provide detailed incident reports, analysis, and recommendations for remediation, including the identification of affected systems, the impact assessment, and the development of strategies to mitigate and prevent future incidents.
Threat hunters actively engage in knowledge sharing and collaboration within their team, with other security teams, and industry peers. This includes sharing insights, best practices, threat intelligence, and lessons learned from threat hunting activities. Collaboration helps enhance the collective knowledge and response capabilities of the organization and the security community as a whole.
ACTIONABLE RECOMMENDATIONS & REPORTING
Our detailed reports provide a comprehensive overview of detected threats, their potential impact, and recommendations to improve your security posture. These insights enable you to make informed decisions and prioritize security measures.
- All Threat Hunting cycles conducted since the previous submitted report
- All queries which were executed during the cycle
- A description of the hunt hypothesis
- A description of any vulnerability or exploit that was identified
- Detailed information about specific threats, characteristics, tactics, techniques, etc.
KEY OUTCOMES & BENEFITS
MDR THREAT HUNTING DATASHEET
Access the datasheet and learn more
