Practical Threat Intelligence and Data-Driven Threat Hunting: A hands-on guide to threat hunting with the ATT&CK (TM) Framework and open source tools

Threat hunting (TH) provides cybersecurity analysts and enterprises with the opportunity to proactively defend themselves by getting ahead of threats before they can cause major damage. This book is an introduction for those who don't know much about the CTI and TH world and a guide for those with more advanced knowledge of other cybersecurity fields. It will teach you how to collect data, understand it, set up an environment for TH, plan a hunt, and explore the MITRE ATT&CK framework.

\n Format: Paperback / softback
\n Length: 398 pages
\n Publication date: 12 February 2021
\n Publisher: Packt Publishing Limited
\n

Threat hunting (TH) is a crucial cybersecurity practice that empowers analysts and enterprises to proactively defend against threats before they cause significant damage. This comprehensive book serves as an introduction for those new to the field, as well as a guide for those with advanced knowledge in other cybersecurity domains seeking to establish a TH program.

Chapter 1: Understanding Threat Intelligence

In this chapter, readers will delve into the realm of threat intelligence, exploring its definition, key concepts, and practical applications. They will learn how threat intelligence is gathered, analyzed, and used to identify and prevent cyber threats. The chapter will also introduce the concept of cyber threat actors and their motivations, helping readers understand the adversarial landscape.

Chapter 2: Collecting and Analyzing Data

Chapter 2 will guide readers through the process of collecting and analyzing data for threat hunting. It will cover the various data sources available, such as network traffic, logs, and social media, and discuss the techniques used to extract meaningful information from these sources. Readers will learn how to develop data models and use them to understand the behavior of threat actors and their tactics.

Chapter 3: Setting Up an Environment for Threat Hunting

Chapter 3 will focus on setting up an environment for threat hunting using open-source tools. Readers will learn how to install and configure Elasticsearch, Logstash, and Kibana (ELK) server, which serves as a centralized platform for storing and analyzing data. They will also explore the benefits of using ELK and how it can be integrated with other security tools and systems.

Chapter 4: Planning a Hunt

Chapter 4 will provide practical guidance
guidance on planning a hunt. Readers will learn how to identify the target environment, set goals and objectives, and develop a plan of action. The chapter will cover the different stages of a hunt, including reconnaissance, enumeration, exploitation, and impact. Readers will also explore the use of tools and techniques such as vulnerability scanning, network mapping, and social engineering to gather information.

Chapter 5: Using the MITRE ATT&CK Framework

Chapter 5 will introduce the MITRE ATT&CK framework, a widely recognized framework for understanding and responding to cyber threats. Readers will learn how to use the framework to identify and prioritize threats, develop attack patterns, and develop mitigation strategies. The chapter will also provide examples of how to use the framework to simulate threat actor activity in a lab environment and use the information collected to improve security posture.

Chapter 6: Conclusion

In the conclusion, readers will review the key concepts covered in the book
book and highlight the importance of threat hunting in today's cybersecurity landscape. They will also provide tips and techniques for getting started in threat hunting and recommend resources for further reading.

By the end of this book, readers will have gained a comprehensive understanding of threat hunting and the skills needed to carry out effective hunts in their own environments. Whether you are a cybersecurity professional or an enthusiast looking to expand your knowledge, this book is a valuable resource for anyone seeking to stay ahead of the ever-evolving threat landscape.

\n Weight: 738g\n
Dimension: 190 x 236 x 26 (mm)\n
ISBN-13: 9781838556372\n \n