Implementation considerations

Organizational maturity

Security operations teams must review their current capabilities and maturity levels before considering threat hunting

Core capabilities must be in place before looking into threat hunting, such as:

• log management

• threat detection

• security monitoring

• incident response (IR)

Technologies that support traditional monitoring and response functions should also be in place

Are there internal resources available, or funds available for external resources?

Key components

People: Threat hunters with the following skill sets and experience are required to build mature hunt capabilities

Skill sets

• Domain knowledge

• Analytical mindset

• Log analysis

• Knowledge of network architecture

• Attack life cycles

• Security tools

• Attack methods

Experience in security monitoring or incident response would position an analyst well within threat hunting

Leverage internal or external resources, based on your circumstances