Know your audience
When you're attempting to target a message concerning a threat hunt for an audience, there are two things to consider. The first is whether the audience is technical or whether they are concerned with technical actions. If the audience is the local defenders who protect the enterprise each day, then a technical brief and report would be the correct choice. They will be concerned with items such as specific log types, ports, and services that were exploited during an attack.
If the audience is executives that do not have a technical background, then that level of detail will cause issues. They may simply stop actively receiving information and space out as soon as something comes up that they cannot follow quickly. Another possible side effect is that the individual may spend more time during a briefing trying to understand a particular detail and miss other key points that the team wanted to convey.
Regardless of your audience, ensure that the team does...
