{"id":3854,"date":"2022-03-14T09:41:09","date_gmt":"2022-03-14T13:41:09","guid":{"rendered":"https:\/\/solutionsreview.com\/security-information-event-management\/?p=3854"},"modified":"2022-03-14T16:43:10","modified_gmt":"2022-03-14T20:43:10","slug":"how-to-enhance-threat-hunting-in-the-modern-enterprise","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/","title":{"rendered":"How to Enhance Threat Hunting in the Modern Enterprise"},"content":{"rendered":"

\"\"<\/p>\n

As part of Solutions Review’s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014Dave Armlin, the Field CTO for ChaosSearch<\/a>, shares expert insights on enhancing your threat hunting efforts.<\/em><\/strong><\/p>\n

\"\"Cyber-attacks are becoming more widespread, sophisticated, and costly every year. According to a\u202f<\/span>Deep Instinct report<\/span><\/a>, ransomware grew by 435% between 2019 and 2020. The IT services company Parachute estimates that cyber-crime\u202f<\/span>caused nearly $1T worth of damage<\/span><\/a>\u202flast year, with the average data breach costing $6M to organizations that didn’t have robust security automation in place.<\/span>\u00a0<\/span><\/p>\n

Given these alarming trends, the U.S. Department of the Treasury\u202f<\/span>announced<\/span><\/a>\u202fa handful of actions to counter ransomware across the country. These actions include attempting to disrupt criminal networks and virtual currency exchanges responsible for laundering ransoms and increasing incident and ransomware payment reporting to U.S. government agencies, such as the Treasury and law enforcement groups.<\/span>\u00a0<\/span><\/p>\n

Yet, even with these commitments, the private sector is still at risk. FireEye found that\u202f<\/span>50% of CEOs<\/span><\/a>\u202fdon’t think their companies can combat cybersecurity threats. Even more alarming, the Ponemon Institute and IBM\u202f<\/span>found<\/span><\/a>\u202fthat the average time to identify an organizational breach was 212 days while containing those breaches was 75 days. Simply put, it takes companies roughly 9.5 months to remediate cyber-attacks.<\/span>\u00a0<\/span><\/p>\n

Corporate leaders must be proactive in their cyber defense efforts to ward off cybersecurity threats and comply with the latest government regulations. More specifically, modern enterprises have to get better at\u202fthreat hunting. While organizations have traditionally focused on securing the perimeter, threat hunting emphasizes identifying environments that have already been compromised to detect and remediate cyber-attacks.\u202f<\/span>\u00a0<\/span><\/p>\n

Fortunately, building a threat hunting capability isn’t too complex, assuming the correct data and tools exist. Here are the steps every organization should take to enhance their threat hunting proficiency and ensure they’re well-equipped to handle future cyber-attacks.<\/span>\u00a0<\/span><\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/span><\/p>\n

Improve Data Retention<\/span><\/b><\/h3>\n

Data retention is foundational to a robust cyber defense. Without deep and broad data retention<\/a>, organizations are limited in analyzing, making it hard to pinpoint potential vulnerabilities and address threats proactively. To optimize data retention, companies must implement sound data policies, particularly when it comes to sensitive information.\u202f<\/span>\u00a0<\/span><\/p>\n

One of the most important questions to ask on the data retention front is, “how long do we need to store data?” Fortunately, there are many industry-specific rules and regulations already that offer guidance for data privacy and retention. HIPAA, the healthcare patient data privacy law enacted in 1996, is one of the most well-known examples. Payment card industry (PCI) compliance is another mainstream standard that keeps credit card transactions secure. These are just two examples of government-driven data management policy.\u202f<\/span>\u00a0<\/span><\/p>\n

In general, if an organization stores personal data or private company information, leaders should have a clear data retention policy, especially regarding how long data should be maintained. Data retention policies can spell out when data is no longer critical for achieving enterprise goals, preventing people from getting rid of information that could potentially be useful down the road.<\/span>\u00a0<\/span><\/p>\n

Updating data policies and retention according to the latest guidelines helps companies make better decisions regarding what to do with their data. And when leaders know that data retention enables threat hunting, they can enact the correct protocols to maintain data as long as necessary to fight long-tail intrusions from advanced persistent threats (APTs).<\/span>\u00a0<\/span><\/p>\n

Leverage Threat Hunting Tools: Logs, SIEM, XDR<\/span><\/b><\/h3>\n

In addition to enhancing data retention, modern enterprises have to take full advantage of their log activity. Large companies generate billions of logs that represent user logins, application record changes, network service interruptions, and more. Log data, paired with thoughtful data retention policies, can strengthen cyber defense significantly, as IT teams have more information about who is accessing applications, how they are doing it, and when.<\/span>\u00a0<\/span><\/p>\n

Data teams that can collect logs, correlate events, describe patterns, and identify anomalies can leverage log analytics and threat hunting tools to control IT operations and neutralize threats. SIEM and XDR tools are two specific types of threat hunting tools that upgrade a company’s ability to find threats before they turn into significant problems.\u202f<\/span>\u00a0<\/span><\/p>\n

Security information and event management tools (SIEM)<\/a><\/strong> are characterized by their ability to provide real-time analyses about active threats and a network’s security posture. Extended detection and response (XDR) tools consolidate threat data from the web, cloud, servers, and email systems in one place, giving security teams a complete view of the threat landscape. XDR tools help study historical data and trends, while SIEM tools keep IT teams apprised of what’s happening today.\u202f<\/span>\u00a0<\/span><\/p>\n

SIEM and XDR tools, coupled with solid data retention policies and log analytics, empower organizations to detect and respond to threats faster, which is critical in today’s ever-evolving world. However, to be clear, SIEM and XDR tools are most effective for short-term operational use cases. To build a reliable cybersecurity function, companies should complement these tools with powerful data platforms capable of storing vast amounts of information over the long term for deeper analyses.\u202f<\/span>\u00a0<\/span><\/p>\n

Use Threat Hunting to Complement Perimeter Defenses<\/span><\/b><\/h3>\n

Companies today have to take a more aggressive approach to cybersecurity. The consequences of cybersecurity attacks are growing increasingly severe every year, and the U.S. government is cracking down on cyber threats, highlighting the urgent nature of the situation.\u202f<\/span>\u00a0<\/span><\/p>\n

Threat hunting is a crucial component of modern cybersecurity strategies and one that depends on an enterprise’s ability to sift through data to identify threats that have already evaded perimeter defenses. Threat hunting success hinges on an organization’s data retention policy and the tools used to conduct hunts. SIEM and XDR tools<\/a><\/strong>, specifically, build on robust data retention policies and make it easier for security teams to execute threat hunting across internal systems. When combined with a larger data platform that stores information at scale and facilitates deeper analysis without requiring much data movement, companies can accelerate accurate threat detection that has the potential to prevent millions of dollars in damages.<\/span>\u00a0<\/span><\/p>\n

Rather than hope that perimeter defenses keep malicious attackers out, enterprises now have to take matters into their own hands, proactively identifying threats and eliminating them as they materialize. Threat hunting will enable organizations to keep pace with tomorrow’s cyber threats\u2014and the time to act is now.\u202f<\/span><\/p>\n

\n


Widget not in any sidebars
<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

As part of Solutions Review’s Premium Content Series\u2014a collection of contributed columns written by industry experts in maturing software categories\u2014Dave Armlin, the Field CTO for ChaosSearch, shares expert insights on enhancing your threat hunting efforts. Cyber-attacks are becoming more widespread, sophisticated, and costly every year. According to a\u202fDeep Instinct report, ransomware grew by 435% between […]<\/p>\n","protected":false},"author":120,"featured_media":3866,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[551,1],"tags":[1792,1791,1793,1790,1433,1745,1656,22,347,1376],"acf":[],"yoast_head":"\nHow to Enhance Threat Hunting in the Modern Enterprise<\/title>\n<meta name=\"description\" content=\"As part of Solutions Review's Premium Content Series, Dave Armlin of ChaosSearch shares insights on how to enhance threat hunting.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How to Enhance Threat Hunting in the Modern Enterprise\" \/>\n<meta property=\"og:description\" content=\"As part of Solutions Review's Premium Content Series, Dave Armlin of ChaosSearch shares insights on how to enhance threat hunting.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/\" \/>\n<meta property=\"og:site_name\" content=\"SIEM Tools & Security Event Management | Solutions Review\" \/>\n<meta property=\"article:published_time\" content=\"2022-03-14T13:41:09+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-03-14T20:43:10+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"800\" \/>\n\t<meta property=\"og:image:height\" content=\"400\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Dave Armlin\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Dave Armlin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/\",\"name\":\"How to Enhance Threat Hunting in the Modern Enterprise\",\"isPartOf\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg\",\"datePublished\":\"2022-03-14T13:41:09+00:00\",\"dateModified\":\"2022-03-14T20:43:10+00:00\",\"author\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60730f6c9c41a0e58c237393e060c1fb\"},\"description\":\"As part of Solutions Review's Premium Content Series, Dave Armlin of ChaosSearch shares insights on how to enhance threat hunting.\",\"breadcrumb\":{\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#primaryimage\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg\",\"contentUrl\":\"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg\",\"width\":800,\"height\":400,\"caption\":\"How to Enhance Threat Hunting in the Modern Enterprise\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How to Enhance Threat Hunting in the Modern Enterprise\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#website\",\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/\",\"name\":\"SIEM Tools & Security Event Management | Solutions Review\",\"description\":\"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60730f6c9c41a0e58c237393e060c1fb\",\"name\":\"Dave Armlin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/be209a1c39de118312a2eae605e16a23?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/be209a1c39de118312a2eae605e16a23?s=96&d=mm&r=g\",\"caption\":\"Dave Armlin\"},\"description\":\"Dave Armlin is VP of Customer Success and Solutions Architecture at ChaosSearch. In his role at ChaosSearch, he works with organizations to harness the disruptive power of activating petabyte-scale data, enabling immediately actionable insight. Dave's experience in data, security, virtualization, cloud, and mobile technologies has come during his time at Sybase, Novell, Cloudswitch, Verizon, HubSpot, and ChaosSearch. He holds a Bachelor of Science in Computer Science from Northeastern University.\",\"sameAs\":[\"https:\/\/www.chaossearch.io\/\",\"https:\/\/www.linkedin.com\/in\/darmlin\/\"],\"url\":\"https:\/\/solutionsreview.com\/security-information-event-management\/author\/darmlin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How to Enhance Threat Hunting in the Modern Enterprise","description":"As part of Solutions Review's Premium Content Series, Dave Armlin of ChaosSearch shares insights on how to enhance threat hunting.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/","og_locale":"en_US","og_type":"article","og_title":"How to Enhance Threat Hunting in the Modern Enterprise","og_description":"As part of Solutions Review's Premium Content Series, Dave Armlin of ChaosSearch shares insights on how to enhance threat hunting.","og_url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/","og_site_name":"SIEM Tools & Security Event Management | Solutions Review","article_published_time":"2022-03-14T13:41:09+00:00","article_modified_time":"2022-03-14T20:43:10+00:00","og_image":[{"width":800,"height":400,"url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg","type":"image\/jpeg"}],"author":"Dave Armlin","twitter_misc":{"Written by":"Dave Armlin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/","url":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/","name":"How to Enhance Threat Hunting in the Modern Enterprise","isPartOf":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website"},"primaryImageOfPage":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#primaryimage"},"image":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#primaryimage"},"thumbnailUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg","datePublished":"2022-03-14T13:41:09+00:00","dateModified":"2022-03-14T20:43:10+00:00","author":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60730f6c9c41a0e58c237393e060c1fb"},"description":"As part of Solutions Review's Premium Content Series, Dave Armlin of ChaosSearch shares insights on how to enhance threat hunting.","breadcrumb":{"@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#primaryimage","url":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg","contentUrl":"https:\/\/solutionsreview.com\/security-information-event-management\/files\/2022\/03\/How-to-Enhance-Threat-Hunting-in-the-Modern-Enterprise.jpg","width":800,"height":400,"caption":"How to Enhance Threat Hunting in the Modern Enterprise"},{"@type":"BreadcrumbList","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/how-to-enhance-threat-hunting-in-the-modern-enterprise\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/solutionsreview.com\/security-information-event-management\/"},{"@type":"ListItem","position":2,"name":"How to Enhance Threat Hunting in the Modern Enterprise"}]},{"@type":"WebSite","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#website","url":"https:\/\/solutionsreview.com\/security-information-event-management\/","name":"SIEM Tools & Security Event Management | Solutions Review","description":"Evaluating Enterprise SIEM Systems, Log Management Analytics & SOAR Platforms.","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/solutionsreview.com\/security-information-event-management\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/60730f6c9c41a0e58c237393e060c1fb","name":"Dave Armlin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/solutionsreview.com\/security-information-event-management\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/be209a1c39de118312a2eae605e16a23?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/be209a1c39de118312a2eae605e16a23?s=96&d=mm&r=g","caption":"Dave Armlin"},"description":"Dave Armlin is VP of Customer Success and Solutions Architecture at ChaosSearch. In his role at ChaosSearch, he works with organizations to harness the disruptive power of activating petabyte-scale data, enabling immediately actionable insight. Dave's experience in data, security, virtualization, cloud, and mobile technologies has come during his time at Sybase, Novell, Cloudswitch, Verizon, HubSpot, and ChaosSearch. He holds a Bachelor of Science in Computer Science from Northeastern University.","sameAs":["https:\/\/www.chaossearch.io\/","https:\/\/www.linkedin.com\/in\/darmlin\/"],"url":"https:\/\/solutionsreview.com\/security-information-event-management\/author\/darmlin\/"}]}},"_links":{"self":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/3854"}],"collection":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/users\/120"}],"replies":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/comments?post=3854"}],"version-history":[{"count":0,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/posts\/3854\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media\/3866"}],"wp:attachment":[{"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/media?parent=3854"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/categories?post=3854"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/solutionsreview.com\/security-information-event-management\/wp-json\/wp\/v2\/tags?post=3854"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}