simpl.
Anmelden
Cybersicherheits-GRC 12 Punkte

Threat Hunting Program Readiness

Diese Checkliste ist auf Englisch.

Evaluates the readiness of a proactive threat hunting program, covering hypothesis development, data access, hunt execution, and the operationalization of findings into detections.

MITRE ATT&CKNIST 800-53

Kostenlos als PDF oder Word · E-Mail-Adresse eingeben und herunterladen.

Program Foundation

  • Is threat hunting a defined, funded function distinct from alert triage? *
  • Is a hunting methodology (hypothesis-driven, IOC-driven, or TTP-driven) documented? *
  • Are hunts prioritized using threat intelligence and organizational risk? *
  • Are hunters granted read access to the required telemetry and raw data? *

Hunt Execution

  • Does each hunt begin with a documented hypothesis tied to an ATT&CK technique? *
  • Is the data required to test the hypothesis confirmed available before the hunt? *
  • Are hunt findings, queries, and results documented for repeatability? *
  • Are visibility gaps discovered during hunts logged as data-source improvements?

Findings & Handoff

  • Are confirmed malicious findings escalated to incident response? *
  • Are successful hunts converted into automated detections where possible? *
  • Are hunt outcomes (findings, gaps, new detections) reported to stakeholders? *
  • Is ATT&CK technique coverage from hunts tracked over time?

Vollständige Checkliste Threat Hunting Program Readiness herunterladen

Kostenlos als übersichtliches, druckfertiges PDF oder als bearbeitbares Word-Dokument.