Threat hunting
Rules catch what someone thought to write a rule for. Hunts search the data you already store for activity no rule has flagged yet.
An attacker who avoids your rules raises no alerts. The only way to find them is to go and look.
Hunting needs uninterrupted hours, and alerts keep interrupting.
A good hunt starts from a clear idea of what an attacker would do. Writing one takes experience.
A hunt that needs logs you do not collect finds nothing, and says nothing about why.
A hunt that returns a thousand rows leaves a person to work out which ones matter.
Each pack says what it needs, so you start with the hunts that will work and see what to add for the rest.
Hunts are grouped into packs by attacker technique, and each one says what data it needs. The packs your data can already answer are ready to run; the rest say what to add.
Run a hunt when you have a question, or schedule it to run regularly so it keeps watching. Scheduled hunts run whether or not anyone is at a desk.
The agent reads what a hunt finds and says whether it looks like an attack, so a person starts from a conclusion rather than a list of matches.
When a hunt finds something worth catching every time, ask the agent to draft a detection rule for it. A person approves the rule before it goes live.
Choose from packs grouped by attacker technique. Each hunt says what data it needs, so you can see which ones your stored data can answer today.
Start a hunt when you have a question, or schedule it to run regularly. Scheduled hunts run whether or not anyone is at a desk.
Instead of leaving you a long list of matches, the agent reads what the hunt found and says whether it looks like an attack, with the evidence attached.
Someone reviews the finding as they would any investigation. If it is worth catching each time, they can ask the agent to draft a detection rule.
Start from what attackers do, not from an empty search box.
Each hunt says whether your data can answer it today.
Keep a hunt running every day or week.
The agent says what the matches mean.
A report of what was searched and what was found.
Ask for a rule from a finding, approved by a person before it goes live.
No. Hunts come ready in packs grouped by attacker technique, and each one knows which data it needs. You can run them as they are, on demand or on a schedule. Analysts who want to go further can still use their own tools alongside.
The security data you already store, starting with Elastic. Each hunt says which kinds of logs it needs, so you can see at a glance which hunts your data can answer today and what you would need to add for the rest.
The agent reads the results and says whether they look like an attack, with the evidence attached. A person reviews it, as with any investigation. armor360 does not act on what it finds; it tells your team.
Start a free pilot on your own alerts, or put in your own numbers first.