re-hunting

What it does: - Develops educated guesses about what attackers might have done in a computer network - Searches through logs and data to find signs of those attacks - Compares normal activity to unusual activity to spot problems - Verifies findings and checks if alerts are real or false alarms When to use it: - You want to actively search for attackers in your network instead of waiting for alerts - You have threat information and want to see if it matches activity in your environment - You need to find similar attacks after discovering one incident - You want to establish what normal looks like before searching for abnormal activity - You are expanding a search after finding one piece of evidence to find related activity