• Table of Contents
  1. Huntbook by Predefender > 
  2. The Huntbook > 
  3. Deliveries

Deliveries

The improvement of understanding is for two ends: first, our own increase of knowledge; secondly, to enable us to deliver that knowledge to others.

– John Locke

Table of Contents

  • Process Documentation
    • SOP
    • Playbook
    • Runbook
  • SITREP
    • Reports
      • No Result Hunts
        • Baselines
          • Detection Rules
            • Audits
              • Home

              • The Huntbook
                • 1. - Basics
                  • Definition
                  • Hierarchy of Needs
                  • The Threat Hunter Persona
                  • Analyst Mindset
                  • Indicators
                  • Context Before Conclusion
                  • From Alerts to Hypotheses
                  • Creating Hypotheses
                  • Planning a Threat Hunt
                  • How to Start a Threat Hunting Program
                  • When to Engage Threat Hunters
                • 2. - Frameworks
                  • Diamond Model
                  • Lockheed Martin Kill Chain
                  • Unified Kill Chain
                  • MITRE ATT&CK
                  • OODA Loop
                  • Pyramid of Pain
                  • Threat Hunting Frameworks
                    • PEAK
                    • TaHiTI
                    • MaGMa
                • 3. - Methodology
                  • Hypothesis-Driven Hunting
                  • Anomaly-Driven Hunting
                  • Intelligence-Driven Hunting
                • 4. - Deliveries
                  • Process Documentation
                    • SOP
                    • Playbook
                    • Runbook
                  • SITREP
                  • Reports
                  • No Result Hunts
                  • Baselines
                  • Detection Rules
                  • Audits
              • Lab
                • Setting Up a Basic Lab
                • Setting Up a Complete Lab
                • API Bulk Ingesting Logs
                • Ingesting Windows Logs
                • Ingesting with Filebeat
              • Techniques
                • Understanding Data
                • Establishing Timeline
              • Field Notes
                • Intelligence Resources
                • MITRE ATT&CK Field Notes
                  • T1105 - Ingress Tool Transfer
                  • T1566 - Phishing
                • SIEM Query Languages
                • Windows Logins
                • MAC Addresses
              • Cheat Sheets
                • IP Protocol Numbers
                • Kusto Sentinel Tables
                • Network Services
                • PowerShell
                • Sysmon
                • Windows Registry
              • Detection Engineering
                • Hunter to Detection
              • About
                • About
                • FAQ
                • Contact

              •  
              •  
              •  
              RSS Feed

              Copyright Roger Johnsen

              All rights reserved.