Chapter 12: Deliverables

What is the difference between a group of individuals that do things and a focused team accomplishing tasks? If we put aside the colorful words, it's the deliverables that make a difference. A lot of time and effort goes into threat hunting, but if everyone simply moves on with their lives once it is done, then most of that effort will be wasted and pointless before they even leave the facility.

Throughout the entire threat hunting process, communication and detailed documentation will have occurred in each phase. The final deliverables are where all of this extra effort shows its worth and why certain threat hunting teams are requested time and time again, while others are quickly forgotten. The first few times a team produces deliverables in the form of documentation, the process will be stressful. The team may not have prepared ahead of time, members may have slacked on their documentation throughout the hunt, data may have been missed or even deleted...