Archive

Please reload

Tags

Please reload

Hunting Analytic Catalog | Playbook | Database

September 3, 2017

In my first post I went over some threat hunting models. For the R&D hunts, I mentioned that it would require every hunt to be cataloged. Then I started to try to create the outcome document from an R&D Hunt to share it with everyone and ran into a terminology roadblock of my own making.

 

I couldn't seem to make progress on outlining the expected outcome from R&D Hunts, at least not in a concise way that would be easy for my team and my leadership to comprehend. So, I decided to use writing a post to walk myself through the process and the terminology.

 

Campaigns  & Hunts
Campaign

 

  • Description: Two or more hunts with a common objective

  • Outcome: A strategic product consolidating the findings from all hunts

Hunt
  • Description: 1 or more hunt techniques with a common objective

  • Outcome: A report containing actionable findings

 

Hunting Analytics

 

Description: A hypothesis applied to a specific domain, for a specific datasource, using a specific tactic

 

Outcome: Unit of work for a hunter

 

For me, the hunting technique is what the hunter does to test the hypothesis and with a favorable outcome it becomes a skill in her toolbox.

 

The hunting analytics are what need to be cataloged for a scalable hunt program, so that is why I was getting so stuck trying to come up with the documentation after an R&D Hunt, its documenting the hunting analytic itself. 

 

Now I was able to dive into what type of metadata I wanted to store with each hunting analytic.

 

 

 

 

 

 

 

 

 

 

 

The Deep Dive

The hunting analytic is the way to describe and therefore document what a hunter does. On the right side of the image I have what I consider the main attributes of the technique and over on the left I have additional metadata that, while isn't required, I could see being useful when building out the playbook or catalog.

 

I have created a spreadsheet that smaller organizations or individual hunters could use to track their work, but larger organizations will likely need a database. I have yet to use the tracker, so I am sure some modifications are needed so please feel free to share ideas or mods you made in the comments, or if the tracker was just a waste of time.

 

My DBA days were rooted in relational databases, but this seemed like a good candidate for me to try out a document-oriented database, MongoDB, for the larger organizations. I will create another post specifically about this endeavor because its just going to take me a little longer, but progress will be in my GitHub. If you are interested collaborating on the HT Trackr, let's do it.

 

Happy Hunting,

~K

 

 

Please reload

Recent Posts

Please reload

Virginia, USA

©2017 by Happy Threat Hunting.  

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.