Proactive Threat Hunting
Proactive Threat Hunting Incident
Details
| ID | Proactive Threat Hunting |
|---|---|
| Group | incident |
| Version | -1 |
| From Version | 6.9.0 |
Layout Structure
Legacy Summary 0 sections
No sections defined.
Evidence 4 sections
Updates For The Hunter
Evidence Results
Instructions
Close Investigation Notes
| Field ID | Position |
|---|---|
| closenotes | Col 0-2, Height: 22 |
Hunt Results 7 sections
Hunting Hypothesis - SDO Details
The hunted SDO details. These details include the SDO's name, source feed, as well as any associated attack patterns and related tools. It's important to note that the hunt will only cover attack patterns and techniques that have relevant tool data from the existing Threat Intelligence Management (TIM) feeds
| Field ID | Position |
|---|---|
| sdoname | Col 0-1, Height: 106 |
| sdofeed | Col 0-1, Height: 106 |
| tools | Col 1-4, Height: 53 |
| attackpatterns | Col 1-4, Height: 53 |
SDO Hunt Results - Summary
A summary of the hunt results including tool usage found, affected hosts and affected users
| Field ID | Position |
|---|---|
| toolusagefound | Col 0-1, Height: 53 |
| affectedhosts | Col 1-2, Height: 53 |
| affectedusers | Col 2-4, Height: 53 |
Hunting Hypothesis - SDO Related IOCs
IOCs to search in the hunt
Detected IOCs
IOCs found during the hunt
Suspicious
| Field ID | Position |
|---|---|
| suspiciousexecutionsfound | Col 0-4, Height: 106 |
SDO Hunt Results
This section displays the comparison results between malicious tool patterns and command-line arguments found within the environment.
| Field ID | Position |
|---|---|
| stringsimilarityresults | Col 0-4, Height: 106 |
Updates For The Hunter
Investigation & Response 5 sections
Entity Enrichment
Upon executing a entity enrichment, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| endpointsdetails | Col 0-6, Height: 44 |
| usersdetails | Col 0-6, Height: 44 |
| relatedalerts | Col 0-6, Height: 44 |
Actions
Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| endpointisolationstatus | Col 0-1, Height: 53 |
| userblockstatus | Col 0-2, Height: 53 |
| blockindicatorsstatus | Col 0-2, Height: 53 |
Updates For The Hunter
Instructions
Follow the instruction to build and execute your hunting query.
Custom Query Results
Upon executing a custom query, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| customqueryresults | Col 0-2, Height: 106 |
Freestyle Hunting 5 sections
Entity Enrichment
Upon executing a entity enrichment, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| endpointsdetails | Col 0-6, Height: 44 |
| usersdetails | Col 0-6, Height: 44 |
| relatedalerts | Col 0-6, Height: 44 |
Actions
Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.
| Field ID | Position |
|---|---|
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| — | Col 0-2, Height: 53 |
| endpointisolationstatus | Col 0-1, Height: 53 |
| userblockstatus | Col 0-2, Height: 53 |
| blockindicatorsstatus | Col 0-2, Height: 53 |
Updates For The Hunter
Query Instructions
Follow the instruction to build and execute your hunting query.
Custom Query Results
Upon executing a custom query, the results will be promptly displayed in this section.
| Field ID | Position |
|---|---|
| customqueryresults | Col 0-2, Height: 106 |
Investigation & Response copy 5 sections
Entity Enrichment
To get entities details, click "Entity Enrichment" in the actions section.
| Field ID | Position |
|---|---|
| endpointsdetails | Col 0-6, Height: 44 |
| usersdetails | Col 0-6, Height: 44 |
| relatedalerts | Col 0-6, Height: 44 |
Actions
Set of post-hunting actions. There is a manual Collection task before the actual remediation. Executing a new action will abort the previous one, if hasn't done yet.
| Field ID | Position |
|---|---|
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| — | Col 0-4, Height: 53 |
| endpointisolationstatus | Col 0-1, Height: 53 |
| userblockstatus | Col 0-2, Height: 53 |
| blockindicatorsstatus | Col 0-2, Height: 53 |
Custom Query Results
| Field ID | Position |
|---|---|
| customqueryresults | Col 0-4, Height: 106 |
Query Status
Query Instructions
Follow the instruction to build and execute your hunting query.
Control Panel copy 3 sections
Query Status
Query Instructions
Follow the instruction to build and execute your hunting query.
Evidence Results
War Room 0 sections
No sections defined.
Work Plan 0 sections
No sections defined.
Evidence Board 0 sections
No sections defined.
Related Incidents 0 sections
No sections defined.
Canvas 0 sections
No sections defined.
Cheat Sheet 1 section
Cheat Sheet
| Field ID | Position |
|---|---|
| cheatsheet | Col 0-6, Height: 44 |