MENU
The threat-hunting team has identified suspicious activity. An analyst manually creates a notable event using an event action to track the activity. How should a detection engineer ensure this activity automatically produces findings in the future?
The appropriate operationalization step is to convert the threat-hunting discovery into a correlation search. The question distinguishes between a one-time manual notable created by an analyst and repeatable detection logic capable of identifying the same behavior automatically in future telemetry. A correlation search is the Splunk Enterprise Security mechanism designed to run detection logic on a defined schedule and trigger configured security outcomes when matching events are found.
A SOAR playbook is primarily a response and orchestration mechanism. It can enrich, contain, notify, or otherwise act on findings, but it is not the correct replacement for the core analytic responsible for continuously detecting the behavior. Similarly, applying a risk modifier could contribute evidence to Risk-Based Alerting, but it does not by itself satisfy the explicit requirement to automatically produce findings matching the threat-hunting activity.
The engineering progression represented here is therefore: hunt validate suspicious behavior convert the successful hypothesis into a repeatable correlation search generate analyst-consumable findings.
Study Guide topics: threat hunting, correlation searches, detection operationalization, notable findings, detection lifecycle.
Currently there are no comments in this discussion, be the first to comment!