The Art of Threat Hunting

🔥First of all, it is imperative to clarify that this summary should serve to help you understand whether this book is for you. If it is not, that is also perfectly fine, since my goal is that no one buys the book without knowing what they are buying🔥

_Introduction about what the book is about

This book, “The Art of Threat Hunting: A practical Journey from core fundamentals to advanced strategies“ , aims to be helpful both for future threat hunters and current threat hunters, while also being useful for some team leaders or managers. Threat Hunting is a discipline that has largely emerged over the last five years, with particular emphasis on technologies such as EDR/XDR and SIEM. A few years after starting my career in cybersecurity, I was fortunate enough to begin learning a great deal about Threat Hunting when almost no one was working in this role. This allowed me to see how both the technologies that support it and the professionals involved have evolved, as well as how the needs surrounding the discipline have changed.

Most people believe they understand threat hunting, but in reality they do not. Almost every company claims to practice it, but that is not true, or at least not entirely. I have seen this firsthand and have heard the experiences of dozens of people from different countries working in all kinds of companies. It is a young role with a long path ahead, but this book aims to help and provide context both for getting started and for refining certain techniques, as well as exposing myths and providing structure when organizing a TH team, helping identify where efforts should be focused.

Throughout the book, improvement ideas, concepts, and standards are proposed. These have been inspired by working models that I have learned, experienced, or conceived at some point and later tested in practice, where they proved effective. It is not a “from zero to hero” guide, but it can give you an idea of how to begin, provide basic concepts and techniques, show what to pay attention to, and most importantly clarify what TH is and what it is not.

Additionally, different examples, situations, and real incidents are explored where TH, and particularly myself, propose ways to solve them, define our scope, and present the most logical ways to face the problems encountered within this role.

In the book you will find graphs (in color, yes, I have decided to ruin myself financially) and methodologies created by me describing different aspects, trying to make them as usable and easy to understand as possible for any level.

_Scope and who it is for

This book can be used by different cybersecurity teams or professionals. Although the main focus is on TH teams, I believe it can also be used by other Blue Team departments such as CTI or DFIR, and even by Red Team members, since I place particular emphasis on the need, along with examples and practical situations, of collaborating with other teams and developing good working practices between them.

However, the main usability of the book will be for:

• Threat Hunting teams and professionals aiming to understand or improve standardized methodologies, hypotheses, and advanced investigation techniques.

• CTI departments seeking to establish an effective technical collaboration and feedback channel with hunting teams.

• SOC / IR / DFIR teams looking for support in proactively identifying and hunting adversaries or campaigns.

• Security managers / CISOs who need to understand the activities carried out by TH or justify and recognize the value of the team within their organization or provider.

• Consulting firms or MSSPs aiming to professionalize their TH service and align it with mature practices offered by other competitors in the market.

_Covered content (Index)

I believe a book should not be judged by its cover (even though this one turned out pretty awesome, right?), so I will make it easier by showing you the index.

1 Introduction
2 Why TH & How to use It
3 CTI Driven
4 Standardize TH
5 Research Types
6 Knowledge for TH
7 Hypothesis Generation
8 Queries & Challenges
9 Documentation
10 TH Tools
11 Final Thoughts
Notes

_Type of content

To make things even simpler, since it is a book of more than 200 pages (not that much, TikToker), I think it is easier to look at it from the perspective of whether the content is more strategic, which may be more useful for management or intelligence departments, or more technical, which can be used by members of Blue Team or Red Team who are more focused on technical aspects.

I believe that, aside from the first sections, chapters (2) Why TH & How to Use It and (3) CTI Driven are useful for all kinds of teams, since cybersecurity professionals frequently interact with other departments, either within our own companies or in other organizations. Many of us do not fully understand what other colleagues actually do or stop doing. Knowing exactly what they do and how they do it can quickly give us an idea of whether a department is mature and knowledgeable. I also strongly believe that CTI should be involved in every area of a company, which is why I consider it something transversal.

On the other hand, regarding the content, I also believe it is beneficial for other profiles who may no longer want to lead or be involved in technical aspects to still understand the other side. It is interesting to know all perspectives in order to contribute value from as many angles as possible within a team and understand all the positions that converge within it. This can often help get the most out of TH.

Strategic content

Mostly concentrated in:

(4) Standardize TH
(9) Documentation
(6) Knowledge for TH (partially)

Without a doubt, chapters (4) Standardize TH, (9) Documentation, and even part of (6) Knowledge for TH, together with the previous chapters mentioned earlier, contain a strong organizational and management component. After seeing countless managers, both in my own teams and outside of them, who literally did not understand what TH was or how to leverage it, sometimes putting contracts at risk or making executives nervous, it becomes interesting to understand how to make the most of each procedure to extract the maximum value from daily work.

TH is not something linear and, being such a young role, not all executives will understand it. Therefore, it will be the responsibility of managers or team leaders to demonstrate the value of these teams and materialize their work, as well as understand how and why investigations should be conducted.

TH can have moments where there is a lot of information and others where there is nothing at all. It is the job of a good manager to know how to manage this and communicate information correctly, as well as how to use resources properly so that the team does not burn out.

Technical content

Mostly concentrated in:

(5) Research Types
(6) Knowledge for TH (partially)
(7) Hypothesis Generation
(8) Queries & Challenges (partially)
(10) TH Tools

On the technical side, the more technical aspects appear conceptually in Research Types, which later materialize in Hypothesis Generation. During these chapters we test technical capability and how to apply this knowledge. Everyone talks about hypotheses, but putting them into practice and maintaining good methodology is not that easy. Several real analyses are explored while applying the proposed methodologies.

Additionally, the book explores the usefulness of different tools for conducting TH, placing special emphasis on their usability for threat hunting and how to use them, while understanding the scope of a hunter.

In sections such as Knowledge for TH, we clarify basic concepts as well as specific techniques to pay attention to depending on what we are looking for. This area can be very complex and must be adapted according to the needs and objectives of both the team and the company it belongs to.

The chapter Queries & Challenges should be present in both strategic and technical aspects, since a hunter must anticipate certain things. However, the broader vision that a team leader must have should anticipate future problems. Literally, most teams I have encountered consistently fail at this point and are unable to think in the medium and long term, sacrificing efficiency and longevity for urgency.

_No more excuses

Well, after dissecting my own creation to which I have dedicated nearly 10 months of total work, I hope that at least it has helped you determine whether it is for you or not.

I have truly dedicated a lot of work and care to it, trying to make it not too long or dense but still usable for different teams, writing what I would personally like to read if I wanted to learn about TH, work in this department, or improve my skills.

If you made it this far and support my work, I really appreciate it. It is genuinely difficult to find time for all these things.

If the book fits what you are looking for, that is great and I am infinitely grateful for your purchase. I have tried to make it affordable for any budget.

🔗Link to Amazon 👉 https://www.amazon.com/Art-Threat-Hunting-Fundamentals-Strategies/dp/B0GTWFVSTS/

Happy hunting :)