Scenario B – external threat hunt
Since the team has been set, the team lead now works with the team to identify the restraints that the CSI personnel will utilize on this threat hunt. Some of the restraints that they determine are listed as follows:
- No hunting will take place on the operational network due to a lack of experience on CSI's part.
- Any legal findings will be handed off to the company immediately.
- Any automated or interactive adversary findings will immediately be identified to the company.
- All hunt and analysis work will be accomplished with strong chain-of-custody controls.
After the restraints are codified in the plan, the constraints are determined through meetings with stakeholders. Some of these constraints are listed as follows:
- Communication will remain within privileged channels for the organization.
- The threat hunt team will get all tools approved by the security team and legal department.
- All CSI personnel...
