How do you actually threat hunt?

• sysmon-config

  35 4,573 0.0

  Sysmon configuration file template with default high-quality event tracing

If you don't catch it what changes can you do to your logging to enable it? Can you push it out to the environment? While sysmon is awesome, you can do your hunts with built in logging most of the time... Just might not have all the data around it you want to have. I would throw sysmon on a test box (make sure you have a config file that filters out the noise: https://github.com/SwiftOnSecurity/sysmon-config)

• attack-stix-data

  58 284 4.1 Python

  STIX data representing MITRE ATT&CK

  

If you have not yet looked at it, check out mitre att&ck https://attack.mitre.org/

• InfluxDB

  www.influxdata.com featured

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• sigma

  41 7,624 9.8 Python

  Main Sigma Rule Repository

  

Agreed in general. But with stuff like SIGMA, I'd lean towards stuff should going into git. Better version control, your docs can be markdown and live right next to your threat library, you can strap on CI/CD (so you can deploy/run stuff as part of a pipeline). Confluence is a great start, but it doesn't scale well.

Suggest a related project