Threat hunting when you are the only security person is a challenging job to take on.

You are responsible for everything that remotely sounds like security, so someone is always bringing a problem (or complaint) to you to fix. As important actively monitoring your environment is, it doesn’t scream at you like a down host or urgent deadline, so it is very tempting to only depend on automated defenses. The problem is that those notifications usually come late in to an intrusion.

I found myself stuck in this trap and managed to break out of it while still juggling all the sudden “emergencies” that people brought to me. Here’s what I did.

Made Time to Implement Better Monitoring

The first step was to actually implement the capability to hunt for malicious activity. 

I didn’t have any budget, but I was able to repurpose some old hardware, configure some SPAN ports, and setup Snort, Squil, and other tools to capture network traffic. The whole system was made of open source tools and rules, which allowed me to review events and network data. The tools would be different now, but the idea is the same. It took some late nights and weekend work to get this completed, but it got done.

Today, you can review where your systems and apps are, decide what tools would work, get them implemented, and then schedule the time to do the work.

Made Threat Hunting an “Urgent” Task

The next step was to make doing the hunting a task that had to be done.

No one other than me cared about my new urgent task, but I created a process that had specific output that I tracked to make it more important for me to get it done. I used Jira tickets to track what I discovered during my hunting sessions and required it to be done at least a few times each week. It wasn’t perfect, but it worked, stuff was found and fixed, and I felt a lot better about my work.

There’s not much to change here today, other than how you would want your process to work. Determine what you need to do per hunting session, how to track what you found and how you did it, and put it to work.

Adjust over time and you’ve got the start of your own hunting program.