Summary
In this chapter, we introduced you to the concept of using the data that you had previously enriched as a data point to hunt and pivot for new threat intelligence. We started off by discussing the motivation for hunting and pivoting, introduced you to hunting and pivoting methods, and introduced you to the concept of pivot identifiers, couplers, and footholds. Then, we discussed the malicious data points that could be used to pivot on for both network infrastructure as well as files. Finally, we wrapped the chapter up by discussing several free tools and services that can currently be used to get started right away.
In the next chapter, we will be introducing the concepts of grouping and clustering similar observables based on corresponding attributes. An example of this is clustering together collected malware samples that have shared mutex strings. The next chapter will define both grouping and clustering, and the roles they play in threat intelligence. Should be fun!
...
