Threat Hunting Deep Dive: Intelligence-Based Detection and Response Strategies

Course details

This course offers a comprehensive overview of the integration of threat hunting and intelligence in cybersecurity operations. Starting with a foundational understanding in demystifying threat hunting and intelligence, explore proven threat hunting methodologies that equip you with the necessary strategies to detect and respond to adversarial threats. Next, dive into essential tools and techniques, both open-source and platform-based, to conduct effective intelligence gathering. Then, learn how to develop actionable playbooks tailored for specific scenarios. The course also includes a case study that provides real-world, practical insights into applying intelligence in an actual threat-hunting situation. Finally, wrap up with insights on reporting and continuous improvement and learn to document findings and refine your threat-hunting process for future operations.

Learning objectives
Describe the role of threat intelligence in proactive threat hunting.
Apply intelligence to create effective threat-hunting playbooks.
Use tools and frameworks like MITRE ATT&CK to map intelligence to threat activity.
Analyze case studies of intelligence-led threat hunts to improve strategies.

Concepts

0. Introduction

01 - Threat hunting with intelligence
02 - What you should know

1. Demystifiying Threat Hunting and Intelligence

03 - The analyst mindset
04 - Overview of threat hunting and its importance in cybersecurity
05 - Key components of a threat-hunting cycle
06 - Key components of an intelligence cycle
07 - Types of threat hunting - Hypothesis, anomaly, retrospective
08 - Types of threat intelligence - Strategic, tactical, operational
09 - How intelligence enriches threat hunting

2. Threat Hunting Methodologies

10 - Intelligence-led threat hunting vs. reactive hunting
11 - Introduction to Splunk's PEAK methodology
12 - Hypothesis-driven threat hunting
13 - Baseline-driven threat hunting
14 - The MITRE ATT&CK framework and its use for threat hunting
15 - How to map intelligence to tactics, techniques, and procedures (TTPs)
16 - The diamond model usage for threat hunting

3. Preparing for a Threat Hunt with Intelligence - Tools and Techniques

17 - Open-source tools for intelligence gathering
18 - Commercial tools for intelligence gathering
19 - Open-source tools and techniques - Demo
20 - Log analysis and behavioral analysis tools
21 - Construction of a relationship of intelligence with threat hunting hypotheses

4. Building Threat Hunting Playbooks Using Intelligence

22 - Key elements of a threat hunting playbook
23 - Incorporating threat intelligence into playbooks
24 - Threat hunting playbook example

5. Reporting and Continuous Improvement

25 - Documenting and reporting threat hunting findings
26 - Feedback loop to improve security posture
27 - Retrospective and learning from threat hunts

Conclusion

28 - Next steps