Threat hunting for security visibility in state, local, and education

Devon Kerr

Elastic Security Labs Lead

Elastic

Threat hunting — the proactive pursuit and elimination of adversaries before they cause damage and loss — can help state, local, and education security and analyst teams better understand where important assets reside, such as privileged accounts and sensitive business systems, and provide deeper visibility into activities associated with those assets.

The effectiveness of a threat hunt depends on access to the right data sources. Having the right data means proving or disproving hypotheses more quickly and accurately. For a hunt practice to be effective and capable of operational scale, any data that provides visibility into important assets needs to be easily accessible, and hunt teams need the ability to quickly extract insights from that data.

Elastic Security empowers even the smallest security teams to make the most of all of their data for threat hunting. Because it offers both scale and speed, Elastic Security makes contextual data widely available for ingest, quickly searchable through the power of Elasticsearch, and effectively analyzed through the feature-rich Kibana UI.

Highlights:

• Learn key security insights that can be gained from various data sources
• Learn best practices for improving visibility with threat hunting
• See real-world examples of hunt methods using Elastic Security