1. Old Dead Dudes and Threat Hunting
Active Threat Analytics
Cisco Security Solutions
Evan Strickland, Global Process and Operations Manager

2. What is Threat Hunting? Assumptions: Hunting can be fully automated
Hunting can only be carried out with vast quantities of data and a stack of advanced tools
Hunting is only for elite analysts; only the security 1% with years of experience can handle it
Talk about troubles with various SOCs and the route cause of failure to understand and perform.
Reference: Hunting Evil – Sqrrl; p5

3. What is Threat Hunting? The systematic attempt to identify
malicious behavior that cannot currently be identified
by a defensive tool or employed tactic.
Add that the term was known SANS, but popularized by Splunk around The industry caught onto this term starting in 2016.

4. How you interpret data matters

5. Let’s shed some light on this subject
It would be a tragedy
to not understand
that our
presuppositions direct
our actions
and outcomes
King Leer and his being tired

6. So … what did I sign up for again?
Security and the Art of Argument
The Discipline of Decision
The Philosophy of Cyber Security Operations
Mini-analysis

7. So … what did I sign up for again?
Anagnorisis and Peripeteia: from Ignorance to knowledge
“The Light shines in the darkness, and the darkness did not comprehend it.”
We are in the business of focusing data into insight and action
Andicdote from customer: I don’t want to send you everything because we have never reviewed it and I’m afraid of what you might find
Reference: