| Layer | Main Tools | Key Capabilities | |-------|------------|-------------------| | | SIEM, log management | Log ingestion, event correlation, alert normalization | | Threat Detection & Monitoring | EDR, XDR, IDS/IPS, NTA, UEBA | Endpoint analysis, network anomaly detection, lateral movement detection | | Threat Intelligence & Enrichment | CTI feeds, TIP platforms | IOC matching, threat actor mapping, MITRE ATT&CK mapping | | Response Orchestration | SOAR, case management | Automated playbooks, alert triage, automated response |

Even SOCs without dedicated hunting resources can implement hunting programs using existing tools and analyst time. A no-cost threat hunting program using only existing SOC resources removes obstacles for organizations that don’t employ dedicated threat hunters.

Once an alert is confirmed as worthy of investigation, the analyst enters the core investigative phase. This involves collecting evidence, analyzing logs, enriching indicators with threat intelligence, and forming hypotheses about attacker behavior. A hypothesis is a testable assumption about adversary activity in your environment — focusing on tactics, techniques, and procedures (TTPs) rather than just indicators of compromise (IOCs).

It’s 3:47 AM. Ahmed, a Tier 2 SOC analyst, stares at his SIEM console. A critical alert flashes:

Analyzing network firewall and web proxy logs for C&C communication.

: Inspect internal traffic logs for sudden authentication attempts to adjacent workstations using protocols like RDP, SSH, or SMB. 5. Phase 4: Documentation and Escalation

Never view an alert in isolation. Look for concurrent events across different log sources. For example, a suspicious PowerShell execution (EDR) paired with an unusual outbound connection to an unclassified IP address (Firewall) yields a much higher true-positive probability than either event alone. 3. Deep-Dive Evidence Gathering and Artifact Analysis

While a SIEM watches the environment broadly, EDR solutions go deep—monitoring every process, file change, network connection, and registry modification on individual endpoints in real time.

: Check if the system owner ran a scheduled script or performed maintenance during the alert window.