Alerts and telemetry can be ingested through multiple systems:
EDr/ERP
Firewall
SIEM
Mail providers / Gateway
Iot / OT
Cloud Workloads
IAM, PAM
Signature-based : Criss referenced to out threat intelligence database
Behavioural-based : based on the analytics created by our detection engineers.
- High-Fidelity
- Investigative
- Behavioural
Hypothesis-based / Intel-based Retrospective Threat Hunting:
Emerging threats are transformed into queries and used to conduct proactive hunting through telemetry