Sqrrl Blog

May 25, 2016 11:31:30 AM

Surveying the Threat Hunting Landscape, Part 2: Threat Hunting Practices and Next Steps

In part 1 of this series, we outlined the current state of cyber threat hunting as it was profiled in SANS’s recent survey of 464 companies on the handling of proactive cyber threat detection. In this section, we’ll discuss specifically what types of hunting practices these companies use to track and remove threats in their systems, and we will take a look ahead to see how threat hunting will continue to grow in the future.

In addition to the process of data collection, automation is used to speed up certain parts of the hunting process so that analysts can focus on what’s really valuable, as opposed to having to spend time gathering and parsing through large, disparate data sets. When SANS asked the survey participants what percentage of their threat hunting capacity is automated, the responses were fairly split, with each option (1 - 10%, 11 - 25%, 26 - 50%, 51 - 75%, 76-99%) each receiving about 20%. Each stage in the Threat Hunting Loop provides opportunities for automation that can make the hunting process much more efficient. When forming a hypothesis, automated risk scoring and heat mapping can highlight where to start looking; when investigating, automated visualizations with predetermined pathways and prescribed hunting techniques help you reach your target sooner; automated TTP detection analytics allow you to easily uncover and identify threats; and feeding data back into automated tools to enrich your analytics will only make the process quicker and more powerful for the next hunt.

Read More

Topics: Sqrrl Enterprise, Threat Hunting, Cyber Threat Hunting

May 18, 2016 2:46:33 PM

Surveying the Threat Hunting Landscape, Part 1: The Current State of Threat Hunting


In April, the SANS Institute published the results of the first threat hunting survey to date. The results were gathered from 464 security practitioners in a variety of fields (including financial, cybersecurity, defense contracting, and government organizations) on threat hunting and the role it plays in their security infrastructure. The survey sought to determine if and how organizations are currently hunting, how they feel about their present hunting maturity, and what they have planned for increasing their hunting capabilities in the future. The survey results come at a critical time - today, companies are starting to realize what SANS calls the “three absolute facts” of security: 1) companies cannot prevent every attack; 2) an organization’s network will, at some point, be compromised; and 3) 100% security simply does not exist. It’s imperative, then, that companies try to ramp up their detection capabilities as much as possible to minimize the impact and severity of inevitable cyber attacks.
Read More

Topics: Threat Hunting, Cyber Threat Hunting

May 16, 2016 12:54:05 PM

Sqrrl releases Enterprise 2.5

Sqrrl’s latest release, Sqrrl Enterprise 2.5, revolutionizes the hunt by delivering a wide range of new capabilities aimed at streamlining and automating threat hunting activities for security analysts. By combining big data, analytics, investigation, and collaboration capabilities all in a single tool, Sqrrl Enterprise fulfills all of the requirements of a Threat Hunting Platform. Sqrrl’s hunting approach focuses on identifying, gathering, and acting upon an adversary’s Tactics, Techniques, and Procedures (TTPs), in order to rapidly detect and mitigate threats in your network. This release marks the most comprehensive update to Sqrrl since the release of Enterprise 2.0, which launched the Sqrrl visual investigation interface. These are some of the new features added to Sqrrl to make hunting for advanced threats more streamlined than ever. The new release is generally available to all current Sqrrl users as of  May 16, 2016.

Read More

Topics: Sqrrl Enterprise, Sqrrl, Cyber Threat Hunting

May 4, 2016 1:27:00 PM

Incident Response is Dead... Long Live Incident Response

Originally posted by Scott Roberts, a threat hunter at GitHub, at http://sroberts.github.io/2015/04/14/ir-is-dead-long-live-ir/ 

Talk to anyone in the DFIR Illuminati and one of the topics that always comes up is Hunting. Much like threat intelligence & string theory, people talk a lot about this, but nearly no one knows what it actually means.

Proactive vs. Reactive

At its core, Hunting is about taking a proactive vs a reactive approach to identifying incidents.

Read More

Topics: Cyber Hunting, Incident Response, Threat Hunting, Cyber Threat Hunting