Threat Hunting is the current "Hot Sexy" topic in defensive infosec. It is good and if your org is mature enough, it can be really valuable.
However, *please* remember to turn hunts into monitoring. If you are re-running the same hunts, you are doing it wrong.
As a rule of thumb, make a hypothesis, hunt/test for it. Then if it works (i.e. you can get meaningful data, not just find evil) then convert it into your continuous monitoring.

If you miss this step, you are missing 75% of the point of a threat hunt.
A good example (not my idea!) is a hunt to find if anything has changed the Windows Firewalls settings from default. After this, you could build a daily sweep to check and alert if anything has modified it since the previous scan.
If you turn your hunts into monitoring, your security posture will improve by orders of magnitude.

If you just hunt, or just monitor, it will improve but much, much slower.
You can follow @tazwake.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled: