Threat hunting, threat analytics & data engineering
At Netenrich, we approach everything from the perspective of data, which is how we built the Resolution Intelligence Cloud platform.
Threat hunting is the proactive effort of searching for signs of malicious activity in the digital infrastructure, both current and historical, that have evaded an organization's security defenses. The evasion of security defenses may be due to usage of new, improved, or unknown attacker techniques, 0-day exploits, or a lack of adequate detection technology. Threat hunting assumes a properly running security monitoring process (so incomplete or faulty configuration of detection technology and misinterpretation of security events during triage are not in its scope).
Threat hunting decreases attacker dwell time, the time between an initial compromise and its discovery. As detection capabilities continue to evolve and expand, adversary tactics, techniques, and procedures (TTPs) adapt to evade detection. Comprehensive security telemetry data over time is critical for effective threat hunting; without it, attackers have somewhere to hide.
Data analytics uses statistical analysis and technologies to find trends and solve problems, and threat analytics applies data analytics to security telemetry data to detect threats and incursions. One example is behavioral analytics used to detect adversary behaviors, such as creating a new Windows service. That behavior may or may not be malicious (you need context to figure out whether it is malicious or not). Behaviors map back to techniques in the MITRE ATT&CK model. A single incursion can be represented as an aggregation of multiple behaviors (TTPs) in the ATT&CK model.
Data engineering in general means building systems to enable the collection and usage of data. In the context of threat hunting and cybersecurity, data engineering builds systems to make sense of (1) security telemetry that comes from many diverse sources in multiple formats (end points, servers, clouds, applications, etc.), (2) information that provides necessary context as to whether detected activity is malicious or not, and (3) external threat intelligence about threat in the wild.
