Threat hunting for visibility

Devon Kerr

Director, Security Research

Elastic

Threat hunting — the proactive pursuit and elimination of adversaries before they cause damage and loss — can help analysts and security teams better understand where important assets reside, such as privileged accounts and sensitive business systems, and provide deeper visibility into activities associated with those assets.

The effectiveness of a threat hunt depends on access to the right data sources. Having the right data means proving or disproving hypotheses more quickly and accurately. For a hunt practice to be effective and capable of operational scale, any data that provides visibility into important assets needs to be easily accessible, and hunt teams need the ability to quickly extract insights from that data.

With Elastic Security, contextual data is not only widely available for ingest, but quickly searchable with the power of Elasticsearch and easily accessed through the feature-rich UI of Kibana.

Highlights:

• Learn key security insights that can be gained from various data sources
• Learn best practices for improving visibility with threat hunting
• See real-world examples of hunt methods using Elastic Security