{"id":1283,"date":"2018-02-07T11:59:36","date_gmt":"2018-02-07T15:59:36","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=1283"},"modified":"2018-02-23T11:31:01","modified_gmt":"2018-02-23T15:31:01","slug":"6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/","title":{"rendered":"6 Questions on Digital Threat Hunting with Brandon Dixon of RiskIQ"},"content":{"rendered":"

\"digital<\/p>\n

Digital threat hunting <\/span>is proving to be an increasingly vital component of security analytics platforms\u2014necessary to process the sheer volume of corporate-generated data and find malicious activity. To learn more, we asked Brandon Dixon<\/a>, VP of Product at<\/span> RiskIQ<\/span><\/a>, 6 questions on digital threat hunting. Here\u2019s our conversation, edited slightly for readability: \u00a0<\/span><\/p>\n

1. What is digital threat hunting?<\/b><\/h3>\n

Digital threat hunting is the process of proactively analyzing large quantities of data\u2014those internal to a business and those derived from public internet data sets. By examining these relationships, analysts surface new connections, group similar attack activity, and substantiate assumptions during incident response. This allows them to see the entire scope of the attack targeting them to mitigate its effects and proactively block dangerous infrastructure.<\/span><\/p>\n

2. What are the different kinds of digital threat hunting and how do they differ?<\/b><\/h3>\n

Simply put, you can take a platform or a non-platform approach to threat hunting.<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

There\u2019s really one type of threat hunting, but a number of different data sources that can inform the results. In traditional defense, an analyst may begin exploring information based on suspicious activity or an alert. Hunting is an active process that places a defender in a position to go and look for a compromise within the organization without a specific starting point. This change in tactics forces the hunter to use as much data as possible in order to recognize what\u2019s normal\u2014your baseline\u2014in order to then know what\u2019s anomalous and could be a threat.<\/span><\/p>\n

3. Can threat hunting distinguish between threat severity?<\/b><\/h3>\n

With a thorough investigation, analysts can uncover the scope of an attack and the elements used so the organization can understand its severity. By linking it to a common actor, they can even look up its past attacks to see what the damages and fallout were.<\/span><\/p>\n

4. How do threat hunting initiatives with open source threat feed compare to other platforms and techniques? Are they as easy and cheap as the common perspective suggests?<\/b><\/h3>\n

Let’s say an analyst is doing an investigation of a suspicious IP address. He or she might use one tool for the IP’s WHOIS lookup, which may provide information such as the resolving host, WHOIS history, and contact email for the registrar. In a separate tab, he or she would open another tool for Passive DNS lookup, which pulls in domains resolving to the suspect IP. To see if there is any open source intelligence on the IP, they would open several other tabs. After finding several domains, he or she would open up yet another tab to check them against available hashes.<\/span><\/p>\n

However, all this data\u2014plus more\u2014would be inside a platform<\/a>, which may also add automated analysis to build more context around each IOC (indicators of compromise) surfaced in the investigation. Rather than go from tab to tab, analysts can just pivot on these data sets with a single click, which saves hours and serves as a force multiplier so a single analyst can act as several. Additionally, a platform retains the context from those using the system and serves as a body of knowledge. The more knowledge that\u2019s retained, the higher likelihood someone will make a connection to a new threat later on.<\/span><\/p>\n

5. How can enterprises reduce their digital attack surfaces?<\/b><\/h3>\n

Enterprises can reduce their attack surface by having a real-time inventory of all internet-facing assets, including the components running on assets that may expose the organization to vulnerability risk including: domains, subdomains and hosts, IPs and netblocks, mail and name servers, ownership and WHOIS registration information, server types, components, and frameworks. By knowing this, they can remove assets that are not in use or stood up by attackers and make sure that everything else is patched, up to date, and secure.<\/span><\/p>\n

6. How does digital threat hunting relate to digital business transformation? Does digital business transformation invite digital threats, and how so?<\/b><\/h3>\n

Everyone uses the internet, both the good guys and bad guys. Businesses are building out their digital footprints, adding assets such as microsites and web components to become more visible online and better interact with customers. Meanwhile, successful threat actors are building internet-scale campaigns that can overwhelm defenses. State-sponsored attacks<\/a> are rampant. Each minute, RiskIQ blacklists .3 mobile apps, 100 phishing pages are published, 14.5 malicious ads traverse the digital advertising ecosystem, and 4,300 people get exposed to malware from content theft sites.<\/span><\/p>\n

In the ongoing chess match between businesses expanding their digital presence and the actors trying to exploit growing attack surfaces, those without access to automated internet reconnaissance, whether for bad or good, are at a tremendous disadvantage. Threat hunting using these data sets is the only way analysts can properly hunt this new generation of digital threats.<\/span><\/p>\n

Thanks again to Brandon Dixon of RiskIQ for his time and expertise. <\/b><\/h3>\n

Brandon has spent his career in information security performing analysis, building tools, and refining processes. As VP of Product, he is responsible for managing the direction of all RiskIQ offerings. Prior to RiskIQ, Brandon was the co-founder of PassiveTotal (acquired by RiskIQ) where he led development and product direction. Throughout the years, Brandon has developed several public tools, most notably PDF X-RAY and NinjaJobs. His research and development on various security topics have gained him accolades from many major security vendors and peers in the industry.<\/span><\/p>\n
Widget not in any sidebars
\n","protected":false},"excerpt":{"rendered":"

Digital threat hunting is proving to be an increasingly vital component of security analytics platforms\u2014necessary to process the sheer volume of corporate-generated data and find malicious activity. To learn more, we asked Brandon Dixon, VP of Product at RiskIQ, 6 questions on digital threat hunting. Here\u2019s our conversation, edited slightly for readability: \u00a0 1. What […]<\/p>\n","protected":false},"author":41,"featured_media":1284,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[541,95,145,86,540,21,57,347],"acf":[],"yoast_head":"\n6 Questions on Digital Threat Hunting with Brandon Dixon of Risk IQ<\/title>\n<meta name=\"description\" content=\"We asked Brandon Dixon, VP of Product at RiskIQ, 6 questions on digital threat hunting, an increasingly vital component of security analytics platforms.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"6 Questions on Digital Threat Hunting with Brandon Dixon of Risk IQ\" \/>\n<meta property=\"og:description\" content=\"We asked Brandon Dixon, VP of Product at RiskIQ, 6 questions on digital threat hunting, an increasingly vital component of security analytics platforms.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/\" \/>\n<meta property=\"og:site_name\" content=\"Best Information Security SIEM Tools, Software, Solutions & Vendors\" \/>\n<meta property=\"article:published_time\" content=\"2018-02-07T15:59:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2018-02-23T15:31:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Ben Canner\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Ben Canner\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/\",\"name\":\"6 Questions on Digital Threat Hunting with Brandon Dixon of Risk IQ\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg\",\"datePublished\":\"2018-02-07T15:59:36+00:00\",\"dateModified\":\"2018-02-23T15:31:01+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\"},\"description\":\"We asked Brandon Dixon, VP of Product at RiskIQ, 6 questions on digital threat hunting, an increasingly vital component of security analytics platforms.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg\",\"width\":800,\"height\":400,\"caption\":\"digital threat hunting brandon dixon RiskIQ\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"6 Questions on Digital Threat Hunting with Brandon Dixon of RiskIQ\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"Best Information Security SIEM Tools, Software, Solutions & Vendors\",\"description\":\"Buyer's Guide and Best Practices\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541\",\"name\":\"Ben Canner\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g\",\"caption\":\"Ben Canner\"},\"description\":\"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"6 Questions on Digital Threat Hunting with Brandon Dixon of Risk IQ","description":"We asked Brandon Dixon, VP of Product at RiskIQ, 6 questions on digital threat hunting, an increasingly vital component of security analytics platforms.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/","og_locale":"en_US","og_type":"article","og_title":"6 Questions on Digital Threat Hunting with Brandon Dixon of Risk IQ","og_description":"We asked Brandon Dixon, VP of Product at RiskIQ, 6 questions on digital threat hunting, an increasingly vital component of security analytics platforms.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/","og_site_name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","article_published_time":"2018-02-07T15:59:36+00:00","article_modified_time":"2018-02-23T15:31:01+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg","type":"image\/jpeg"}],"author":"Ben Canner","twitter_misc":{"Written by":"Ben Canner","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/","name":"6 Questions on Digital Threat Hunting with Brandon Dixon of Risk IQ","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg","datePublished":"2018-02-07T15:59:36+00:00","dateModified":"2018-02-23T15:31:01+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541"},"description":"We asked Brandon Dixon, VP of Product at RiskIQ, 6 questions on digital threat hunting, an increasingly vital component of security analytics platforms.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2018\/02\/digital-threat-hunting-mod.jpg","width":800,"height":400,"caption":"digital threat hunting brandon dixon RiskIQ"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/6-questions-on-digital-threat-hunting-with-brandon-dixon-of-risk-iq\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"6 Questions on Digital Threat Hunting with Brandon Dixon of RiskIQ"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"Best Information Security SIEM Tools, Software, Solutions & Vendors","description":"Buyer's Guide and Best Practices","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/357f925262827fcf840b4341920a1541","name":"Ben Canner","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/63f68345052a446ce0cc9c802dd3f373?s=96&d=mm&r=g","caption":"Ben Canner"},"description":"Ben Canner is an enterprise technology writer and analyst covering Identity Management, SIEM, Endpoint Protection, and Cybersecurity writ large. He holds a Bachelor of Arts Degree in English from Clark University in Worcester, MA. He previously worked as a corporate blogger and ghost writer. You can reach him via Twitter and LinkedIn.","url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/bcanner\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/1283"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/41"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=1283"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/1283\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/1284"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=1283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=1283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=1283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}