Baseline Hunting with the PEAK Framework | Splunk

Baselines are an essential part of effective cybersecurity. They provide a snapshot of normal activity within your network, which enables you to easily identify abnormal or suspicious behavior. Baseline hunting is a proactive approach to threat detection that involves setting up a baseline of normal activity, monitoring that baseline for deviations, and investigating any suspicious activity. The PEAK Threat Hunting Framework identifies three types of hunts: In this article, let's take an in-depth look at baseline hunts, also known as Exploratory Data Analysis (EDA) hunts. (This article is part of our PEAK Threat Hunting Framework series. Explore the framework to unlock happy hunting!) Baselining can help you familiarize yourself with new datasets or environments where you've never hunted before. It serves as an excellent precursor to more focused hypothesis-based or model-assisted threat hunting. Before planning and scoping future hunts, it's important to understand the available data

Baseline Hunting with the PEAK Framework | Splunk Baseline Hunting with the PEAK Framework Security July 11, 2023 David Bianco Baselines are an essential part of effective cybersecurity. They provide a snapshot of normal activity within your network, which enables you to easily identify abnormal or suspicious behavior. Baseline hunting is a proactive approach to threat detection that involves setting up a baseline of normal activity, monitoring that baseline for deviations, and investigating any suspicious activity. The PEAK Threat Hunting Framework identifies three types of hunts: Hypothesis-

saved by

• Cooper Edmunds

related reading

• Introducing the PEAK Threat Hunting Framework | Splunksplunk.com
• Model-Assisted Threat Hunting (M-ATH) with the PEAK Framework | Splunksplunk.com
• What Is Cyber Threat Hunting? Complete Guide | Exabeamexabeam.com
• More on Threat Huntingtaosecurity.blogspot.com
• The dotted lines between Threat Hunting and Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• Risk-Based Alerting: The New Frontier for SIEM | Splunksplunk.com
• A guide to threat hunting and monitoring in Snowflake | Datadog Security Labssecuritylabs.datadoghq.com
• Unsupervised Machine Learning with Splunk: the cluster command | by Alex Teixeira | Detect FYIdetect.fyi
• What is Detection Engineering and Why do I Need it?cyberseccafe.com
• Lessons learned from EDR Bypass threat hunting | by Cristóbal Martínez | Mediummedium.com
• Navigating the crossroads of Threat Hunting & Detection Engineering | by Alex Teixeira | Detect FYIdetect.fyi
• Focus Threat Intel Capabilities at Detection Engineering (Part 4) | by Anton Chuvakin | Anton on Security | Mediummedium.com