Scenario A – internal threat hunt
The team lead starts planning for a threat hunt in Widget Makers Inc's networks. The initial restraints that the team identifies are listed as follows:
- Not impacting the non-intellectual property networks (for example, the commercial product networks).
- All illegal activity will be identified to the CEO and legal department lead only.
- The identification of an automated or interactive adversary will stop the hunt, and the FBI will be notified.
- There is no hunting on the operational technology networks.
Constraints communicated by the organization are listed as follows:
- The hunt will take no longer than 15 business days.
- A final written report will not be accomplished—it will be a verbal presentation only.
- Recommendations will be given to legal first to preserve attorney-client privilege.
- There is no direct communication between the threat hunt team, NOC, and SOC—everything goes...
