Splunk Strategist Shares Practical Advice for Building Threat-Hunting Programs
Summary
Splunk strategist David Bianco says threat hunting and red teaming serve complementary roles, and recommends collaborative teams with varied skills and starting with a framework such as PEAK. The article also promotes Team Cymru’s Splunk app.
Key points
- David Bianco distinguishes red teams, which probe systems, from threat hunters, who look for signs that an attacker has already exploited them.
- Red teams can create test incidents to help validate threat-hunting approaches and improve automated detections.
- Bianco recommends collaborative hunting teams with complementary knowledge of threat actors, technology environments, and data analytics.
- He advises starting small and building a program methodically, using a framework such as PEAK to guide and prioritize efforts.
- The article promotes Team Cymru’s Scout App for Splunk as a way to enrich threat data and support investigations.
Article Details
- Topic
- Threat hunting program development and its distinction from red teaming
People
Vendors
SplunkIn my recent conversation with David Bianco, Staff Security Strategist at Splunk, on The Future of Threat Intelligence Podcast, we dug into something that's become increasingly critical in cybersecurity: the distinctionTeam Cymruinto broader security operations continues to evolve. As we see with recent developments like the Team Cymru Scout App for Splunk, the ability to enrich threat data and automate detection is becoming increasingly
Products
SplunkIn my recent conversation with David Bianco, Staff Security Strategist at Splunk, on The Future of Threat Intelligence Podcast, we dug into something that's become increasingly critical in cybersecurity: the distinctionTeam Cymru Scout App for Splunkbroader security operations continues to evolve. As we see with recent developments like the Team Cymru Scout App for Splunk, the ability to enrich threat data and automate detection is becoming increasingly vital.