SPLUNK LOOKUP OUTPUT AND INPUT SERIES

Or, to put it another way, ordered by how much human attention they require in order to find the bad things. The hierarchy consists of four broad categories of detection, ordered by how much automation they offer. But it’s a useful guideline, so let’s take a look at it. Of course, you don’t have to follow it strictly like the Pirate Code, it’s more of a guideline, really. The hierarchy is a model for understanding the different types of detections you can create from your hunts and when each type might be most appropriate. In this post, we’re going to look at something the PEAK framework refers to as the Hierarchy of Detection Outputs. Creating detections can be as easy as “write a new SIEM rule,” and you’re done, but what if your new method isn’t quite that straightforward? Finding these new ways, though, isn’t that useful unless you take the next logical step: turn your hunts into production detections so you don’t have to spend the time and energy hunting them over and over again! Push that work off onto your automated detection systems so you can spend your limited time more productively than re-hunting the same things over and over. Improvement can take many different forms, and we’ll talk about some of these in future PEAK posts, but probably the most obvious is that threat hunting helps you find new ways to detect malicious activity. The real reason to hunt is to drive improvement to your security posture over time. Finding incidents is more like a helpful side effect.

SPLUNK LOOKUP OUTPUT AND INPUT SERIES

If you’ve been following our series on the PEAK threat hunting framework, you might already know that the purpose of threat hunting isn’t just to find security incidents your automated detection systems missed.

Splunk lookup output and input