I Screwed Up Threat Hunting a Decade Ago and Now We're Fixing it With PEAK

on YouTube ↗50m

" summary

A new framework replaces the old four‑step loop with concrete fixes: adds baseline and model-assisted hunting to hypothesis work, prescribes a three‑phase workflow (PEAK: Prepare, Execute, Act, Knowledge), and gives step‑by‑step process diagrams for each hunt type. Metrics shift from “hunts run” to measurable impact — new detections created, incidents later caused by those detections, reported visibility/tool/process gaps and remediations, vulnerabilities found, and techniques hunted. Free ebook and community Slack available.

AI-written summary · about

" chapters (10)

1. 0:00Introduction to the apology
2. 1:02The original squirrel model
3. 5:56Transition to Splunk and Peak
4. 8:47Types of threat hunting
5. 18:05Prepare, execute, and act
6. 25:37Process diagrams for hunting
7. 30:45Continuous improvement goal
8. 34:19Measuring hunt success
9. 42:38Adopting the peak framework
10. 45:40Resources and conclusion

" related talks

• 36mSo You Want to Build a Threat Hunt ProgramBryan Bowie · BSides Tampa 2021
• 31mThreat Hunting — DemystifiedAshish Thapar · RSAC 2020 Asia Pacific & Japan
• 34mFormulating An Intelligence-Driven Threat Hunting MethodologyJoe Slowik · 34th Annual FIRST Conference 2022
• 42mPractical Threat Hunting: Straight Facts and Substantial ImpactsGrifter · BSides Strasbourg 2024
• 40mThe Game of Cyber Threat Hunting: The Return of the FunXiaokui Shu, Dr. Jiyong Jang · RSAC 2021
• 38mHow I Learned to Stop Worrying and Build a Modern Detection & Response ProgramAllyn Stott · Black Hat Europe 2023
• 31mDon't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting ActivityJohn Stoner · BSidesSF 2019
• 40mHunt and Gather: Developing Effective Threat Hunting TechniquesTim Bandos · RSAC 2021