Hardware
In this section, we will list some standard equipment that can be utilized and its intended purpose. Always customize the threat hunt to the unique requirements of the network and team. We will start out with perimeter defense technologies and quickly move onto various pieces of infrastructure that can be utilized throughout a hunt mission.
Perimeter defense
Equipment that performs this type of function will be your hunt team's first line of defense between your systems and any external systems. In all but some of the more extreme isolation hunts, there will be a level of connectivity between the systems used for hunting and external systems. A few things to consider and understand when establishing this secure enclave are as follows:
- There is normally a dedicated security device between the out-of-band hunt network and the customer's network and internet.
- Prior to installation, have a team member perform a vulnerability scan of the defensive system...
