# Module 1: Threat Hunting Concepts and Practices

## Threat Hunting for Enterprises

### Threat Hunting Overview

_Nothing important, hands-on-wise._

<figure><img src="https://2580392783-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F2bsvcHu5JxoX3MBNE1Wb%2Fuploads%2FuIXeyWZnJtRsWnU7136n%2Fimage.png?alt=media&#x26;token=90ec3ceb-c5ed-4c2d-8c32-87774deb8b7f" alt=""><figcaption></figcaption></figure>

### Threat Hunting Within an Organization

The levels of the _Threat Hunting Maturity Model (HMM)_:

* _Initial Level 0_: Relies primarily on automated alerts. No regular data collection.
* _Minimal Level 1_: Uses threat intelligence. Medium to high level of data collection.
* _Procedural Level 2_: Uses procedural analysis. High level of data collection.
* _Innovative Level 3_: Creates new procedural analysis. High level of data collection.
* _Leading Level 4_: Automates most of their analysis procedures. High level of data collection.

### Third-Party Threat Hunting Services

_Nothing to add. Just talking about the benefits of a third-party vs. internal team._

### Threat Hunting Management

The three general stages of threat hunting:

1. Deciding on a trigger or hypothesis
2. Investigation
3. Resolution

## Threat Hunting Methodology and Investigation Types

### Structured Threat Hunting

_Nothing to add. Referencing the MITRE ATT\&CK matrix._

### Unstructured Threat Hunting

_Not much to add. The difference is these are based off from IoCs rather than TTPs._

### Situational/Entity-Driven Threat Hunting

_Specific to threats and risks faced by an organization's environment._
