Building Incident Response Plans + Threat Hunting

Communcation plans

are critical to incident response processes

Stakeholder management plans

are related to communication plans and focus on groups and individuals who have an interest or role in the systems, organizations, or services that are impacted by an incident

Business continuity (BC)

plans focus on keeping an organization functional when misfortune or incidents occur

Disaster recovery (DR)

plans define the processes and procedures when a human-made or natural disaster occurs

Threat Hunting

• Account lockout, which is often due to brute-force login attempts or incorrect passwords used by attackers

• Concurrent session usage when users aren’t likely to use concurrent sessions

• Blocked content

• Impossible travel

• Resource consumption

• Resource inaccessibility

• Out-of-cycle logging occurs when an event that happens at the same time or on a set cycle occurs at an unusual time

• Missing logs may indicate that an attacker has wiped the logs to attempt to hide their actions

• Published/documented describes indicators that have been discovered and published or documented