Gartner Blog Network

Anton’s Favorite Threat Hunting Links

by Anton Chuvakin  |  March 21, 2016  |  6 Comments

Somebody asked me for best resources on THREAT HUNTING, and that reminded me that I wanted to write a linklist blog post on this very topic. Below are some of Anton’s favorite threat hunting links, in no particular order:


Please share your favorite threat hunting links and I will update the post.

P.S. Don’t believe the marketing hype! Effective threat hunting remains the domain of the well-resourced, super-security-mature, extra-skilled security 1%-ers… If you want an extra-cynical version, essentially ~5 people on the planet know how to do it well and can explain to others ….

Additional Resources

View Free, Relevant Gartner Research

Gartner's research helps you cut through the complexity and deliver the knowledge you need to make the right decisions quickly, and with confidence.

Read Free Gartner Research

Category: analytics  incident-response  monitoring  security  soc  

Anton Chuvakin
Research VP and Distinguished Analyst
8 years with Gartner
19 years IT industry

Anton Chuvakin is a Research VP and Distinguished Analyst at Gartner's GTP Security and Risk Management group. Before Mr. Chuvakin joined Gartner, his job responsibilities included security product management, evangelist… Read Full Bio

Thoughts on Anton’s Favorite Threat Hunting Links

  1. […] Anton Chuvakin Somebody asked me for best resources on THREAT HUNTING, and that reminded me that I wanted to write […]

  2. I can’t argue with the idea that hunting is a kind of elite activity right now, but it doesn’t have to be! There’s a perceived barrier that “it’s hard”, which holds some people off. More importantly, though, I think most teams are still playing catchup with detection/response basics.

    I feel strongly that it needs to not be just a 1% capability!

    • Sorry for delayed response. I agree that it needs to expand beyond that and (IMHO) any and all tools that can help such expansion would be great to have on the market….

  3. Andre Gironda says:

    As Richard Bejtlich in The Practice of Network Security Monitoring says on Analysis:

    “Analysis is the process of identifying and validating normal, suspicious, and malicious activity. IOCs expedite this process. Formally, IOCs are manifestations of observable or discernible adversary actions. Informally, IOCs are ways to codify adversary activity so that technical systems can find intruders in digital evidence. For example, the Mandiant APT1 report ( released in February 2013 listed more than 3,000 IOCs, including IP addresses, domain names, and MD5 hashes of tools used by Unit 61398 of the People’s Liberation Army. (Mandiant identifies certain threat groups with the prefix APT, followed by a number, such as APT1, APT2, and so on.)
    I refer to relying on IOCs to find intruders as IOC-centric analysis, or matching. Analysts match IOCs to evidence to identify suspicious or malicious activity, and then validate their findings.

    Matching is not the only way to find intruders. More advanced NSM operations also pursue IOC-free analysis, or hunting.

    In the mid-2000s, the US Air Force popularized the term hunter-killer in the digital world. Security experts performed friendly force projection on their networks, examining data and sometimes occupying the systems themselves in order to find advanced threats. Today, NSM professionals like David Bianco ( and Aaron Wade ( promote network “hunting trips,” during which a senior investigator with a novel way to detect intruders guides junior analysts through data and systems looking for signs of the adversary. Upon validating the technique (and responding to any enemy actions), the hunters incorporate the new detection method into a CIRT’s IOC-centric operations. (Chapter 10 and Chapter 11 contrast the matching and hunting methodologies to demonstrate the strengths and weaknesses of each.)

    Hunting is not special. It’s just an analysis technique. It doesn’t need these complicated guides. You take a few network or memory capture assessments, gather and/or categorize the artifacts, and analyze them.

    The tools and techniques for analysis are what is interesting. When I compare something like Stamus Networks SELKS to SO, I contend there is further value there. Same between Rekall and Volatility, but perhaps less defined. The tools get better, but the techniques are really where the power is.

    Take NetSA (or FlowBAT) and compare it to Cloudera OpenNetworkInsight. Take any SIEM, even MozDef, and compare it to Apache Eagle. Once you integrate modern querying techniques against Big Data, it contrasts the old-school way of doing things pretty heavily.

    FIR and CRITs have nothing on MISP. Moloch is a sad technique compared to OpenNetworkInsight. There are nice things to say about the NoSQL in Elastic, but the ELK stack itself is having components such as LogStash all-but replaced by Heka, or at least supplanted with Kafka (or both). It’s not about using GRR or MIG, but how you use them against adversaries (and the OPSEC and CI HUMINT involved — way more strategic than commercial EDR).

    The big picture for cyber operations, defense, and investigations is in the lifecycle and frameworks, but with a consistent platform. These piecemeal components don’t add up to a singular view. Leverage streaming to Flume and Hadoop… the automation can inquiry the analysts to do the rest. But do build the domain knowledge into your bespoke platform — don’t assume it will do it for you!

  4. Jeff Hall says:

    I don’t recommend hunting to anyone until they can secure their own world. I’ve seen too many instances where organizations are doing great intelligence work but could not secure a paper bag.

Comments are closed

Comments or opinions expressed on this blog are those of the individual contributors only, and do not necessarily represent the views of Gartner, Inc. or its management. Readers may copy and redistribute blog postings on other blogs, or otherwise for private, non-commercial or journalistic purposes, with attribution to Gartner. This content may not be used for any other purposes in any other formats or media. The content on this blog is provided on an "as-is" basis. Gartner shall not be liable for any damages whatsoever arising out of the content or use of this blog.