Over the years, I’ve noticed that having standard operating procedures (SOPs) consistently makes things go better. Writing them isn’t the most exciting part of security, but if done well they continue to pay off over time.

Let’s consider the use of SOPs in threat hunting.

Not Missing Steps in Recurring Tasks

There are a lot of steps in conducting effective threat hunts and remembering everything you need to do is unlikely.

You have multiple data sources, different ways of searching them, and many different commands and queries to run. The chances of missing a step are high, especially when someone interrupts you with a problem they have. You may only be able to periodically do threat hunting, so it’s easy to forget things.

Documenting how you do a threat hunt ensures you aren’t missing opportunities to discover an intrusion.

Improvement Over Time

Threat hunting isn’t static, nor does it arrive in perfect form.

Adversary tactics and methods change over time, and you need to adapt your hunts to what they are doing. As you use your SOPs in repeated hunts, you’ll find ways to build better queries to optimize performance, to make better use of your available data, and to exploit new data sources. You’ll see gaps in what you are looking for and be able to fix that.

By writing out how you do your threat hunts, you will discover ways to improve your hunting.

Someone Else Can Backstop You

Being the only person who can do something is a great way to guarantee you’ll be stuck doing the same work forever.

Someone else could be hired to help you out and you need to get them up to speed. Or you might decide that you’d like to take a vacation and not have your threat hunting stop while you are gone. You may also be up for a promotion because you’ve done such a good job at building your hunting program.

All of these are significant personal benefits to writing SOPs.

Especially the vacation part; so you can rest, refresh, and come back ready to engage with the adversary again.