The threat hunting process

There are several Security Information and Event Management (SIEM) solutions to choose from, and several articles have been written about how they work and how you can choose the one that suits your organization's needs. Later in this book, we are going to use some open source solutions that have been developed using the Elastic SIEM. You should use this type of solution to centralize all the logs that have been collected from your systems to help you analyze the data. It is important to ensure the quality of the data that's collected is good. Low-quality data rarely leads to successful hunts.

Another good starting point is to search for published hunting procedures that you could incorporate into your own processes. You can also create new hunting procedures while keeping the needs and concerns of your organization in mind. For example, you can create hunting processes that focus on specific threat actors that have interest in your organization...