Getting started with threat hunting: five steps to support successful outcomes

Over the last year, 59% of organizations experienced an increase in the complexity of cyberattacks¹. Malicious actors are more cunning than ever, increasingly deploying stealthy human-led techniques to conduct their attacks.

As a result, security teams have turned to the practice of threat hunting in order stop these advanced threats – but it isn’t easy.

In our new guide, Getting Started With Threat Hunting, we cover what threat hunting is, why it has become an essential part of your security efforts, and how to go about it.  We also provide an in-depth overview of the tools and frameworks security teams are leveraging to help them stay ahead of the latest threats and rapidly respond to any potential attacks.

Five steps to help you prepare for threat hunting

As far as security operations go, preparation is key to success. It’s important to lay the right foundations before you begin to hunt in earnest. We recommend the following five steps to set your organization and team up for success:

1. Understand the maturity of your current cybersecurity operations
   Mapping your processes to a cybersecurity maturity model (such as the CMMC) is a great way to establish how well equipped (or not) you are to begin threat hunting. It’s also a good idea to audit your security posture to determine just how susceptible to threats you might be.
2. Decide how you want to go about threat hunting
   Once you’ve established your cyber maturity, you can then decide whether threat hunting is something you want to do in-house, fully outsource, or a combination of the two.
3. Identify technology gaps
   Review your existing tools and identify what else you need to do effective threat hunting. How effective is your prevention technology? Does it have or support threat hunting capabilities?
4. Identify skills gaps
   Threat hunting requires specialist skills. If you don’t have the experience in-house, explore training courses to help develop the necessary skills. Also, consider working with a third-party provider to supplement your team.
5. Develop and implement an incident response plan
   It is essential to have a fully-fledged incident response plan in place to ensure any response is measured and controlled.  Having a well-prepared, well-understood response plan that all key parties can immediately put into action will dramatically reduce the impact of an attack on your organization.

For more details, read Getting Started With Threat Hunting.

Threat hunting enablers

Effective threat hunting requires a combination of next-generation technologies with extensive human expertise.

Prevention technologies – reducing signal fatigue

Threat hunters can only conduct their roles efficiently if they aren’t inundated with security alerts. One way to achieve this is to introduce best-in-class prevention technologies so that defenders can focus on fewer, more accurate detections and streamline the subsequent investigation and response process.

The prevention capabilities in Sophos Intercept X Endpoint protection block 99.98% of threats² enabling defenders to better focus on the suspicious signals that require human intervention.

You can learn more about or take a trial of Intercept X Endpoint here.

Threat hunting technologies – endpoint/extended detection and response (EDR/XDR)

For threat hunters to identify and investigate potentially malicious activities, they need inputs and investigation tools. Enter EDR and XDR. They enable hunters to quickly see suspicious detections and investigate them thoroughly.

EDR provides inputs from the endpoint solution. In contrast, XDR consolidates signals from across the wider IT environment, including firewall, mobile, email, and cloud security solutions. Given that adversaries exploit every attack opportunity, the wider you cast your signal net, the better you can detect them early.

Designed for security analysts and IT administrators alike, Sophos XDR enables your team to detect, investigate, and respond to incidents across your IT estate. Instantly get to the information that matters to you by choosing from a library of pre-written, customizable templates covering many different threat hunting and IT operations scenarios – or write your own.

To test out Sophos XDR’s threat hunting capabilities, you can either start an in-product trial (if you have a Sophos Central account) or take a trial of Sophos Intercept X Endpoint, which includes XDR.

Threat hunting services – managed detection and response (MDR)

MDR, delivered as a fully managed service, empowers organizations with a dedicated team of security analysts hunting for lurking threats 24/7/365. In fact, “51% utilize a managed detection and response (MDR) service provider to help integrate telemetry data for threat detection and response,” according to ESG Research.

MDR providers, like Sophos Managed Threat Response (MTR), have a variety of advantages over an in-house only security operations program. The most significant advantage of them all is often experience.

The Sophos MTR team has thousands of hours of experience, having seen and dealt with everything adversaries can throw at them. They can also learn from attacks on one organization and apply them to all customers. Another benefit is scale: the Sophos MTR team can provide 24/7 support delivered by three global teams.

To discuss how Sophos MTR can support your organization, speak to your Sophos representative or request a callback. In the meantime, catch up on the latest MTR research and casebooks.

¹The State of Ransomware 2022 – Sophos

²AV-Test average score: Jan-Nov 2021