The ThreatQuotient Blog

Security teams continuously look for ways to mature their process and improve their incident response efforts. Incident pruning should be one of the first activities to consider, however, it is commonly overlooked.

In Part 1 of this series I landed on a recalibrated definition of incident pruning. Now, I want to demonstrate how ThreatQ Investigations can handle both incident thinning and incident deadheading methodologies.

Incident response investigations are complex efforts, shifting between chaos and order, as the incident lead maintains investigation alignment with IR policies, while the team chases down every possible clue leaving no stone unturned.

Gartner projects  “by the end of 2022, 30% of organizations with a security team larger than five people will leverage SOAR tools in their security operations, up from less than 5% today.

ThreatQuotient is pleased to announce that we’re an official supporter of another organization called Helping Rhinos.

A mature threat hunting capability should automate the process of collecting intelligence and searching for atomic IoCs, like discrete IP addresses, domains and file hashes.

Headlines about attacks on critical infrastructures are quickly portrayed as a sensation. It is often difficult to find the facts behind the report and to understand the impact of a large-scale cyber campaign on the business.

MITRE ATT&CK dives deep into adversaries’ actions so security analysts can use that information to their advantage. It is a huge step forward in creating a knowledgebase of adversaries and associated TTPs.

Threat hunting, the act of proactively searching for the existence of indicators of compromise within your environment, is a hot topic.