AI-Assisted Network Threat Hunting: A Practical Approach to Visibility and Enrichment

Summary

Troy Woda outlines an analyst-led approach to network threat hunting, covering sensor placement, traffic enrichment, behavioral analysis and the potential use of AI-assisted tooling.

Key points

• Woda describes threat hunting as retroactive detection of activity missed by near-real-time monitoring and emphasizes analyst-led behavioral investigation.
• He recommends baselining assets and structuring collected data to support anomaly detection and efficient queries.
• Internal sensors can help correlate beaconing with individual endpoints, while sensors outside the perimeter can reveal activity involving edge devices.
• Network investigations can use infrastructure ownership, protocols, traffic direction, content and behavioral patterns as context.
• Hunts can identify telemetry gaps and opportunities for new detections even when no malicious activity is found.
• Woda presents his AI-assisted tooling as an early-stage work in progress.

People