GRC Keamanan Siber 12 butir
Threat Hunting Program Readiness
Daftar periksa ini dalam bahasa Inggris.
Evaluates the readiness of a proactive threat hunting program, covering hypothesis development, data access, hunt execution, and the operationalization of findings into detections.
MITRE ATT&CKNIST 800-53
PDF atau Word gratis · masukkan email Anda untuk mengunduh.
Program Foundation
- Is threat hunting a defined, funded function distinct from alert triage? *
- Is a hunting methodology (hypothesis-driven, IOC-driven, or TTP-driven) documented? *
- Are hunts prioritized using threat intelligence and organizational risk? *
- Are hunters granted read access to the required telemetry and raw data? *
Hunt Execution
- Does each hunt begin with a documented hypothesis tied to an ATT&CK technique? *
- Is the data required to test the hypothesis confirmed available before the hunt? *
- Are hunt findings, queries, and results documented for repeatability? *
- Are visibility gaps discovered during hunts logged as data-source improvements?
Findings & Handoff
- Are confirmed malicious findings escalated to incident response? *
- Are successful hunts converted into automated detections where possible? *
- Are hunt outcomes (findings, gaps, new detections) reported to stakeholders? *
- Is ATT&CK technique coverage from hunts tracked over time?
Unduh daftar periksa Threat Hunting Program Readiness lengkap
Dapatkan secara gratis sebagai PDF yang rapi dan siap cetak atau dokumen Word yang dapat diedit.