In a recent session at the RSA Conference 2024, Splunk’s David Bianco delved into the shortcomings of threat hunting frameworks like Sqrrl, a platform he was involved in developing from 2015 to 2017. Bianco acknowledged the limitations of Sqrrl, particularly in its focus on hypothesis-based threat hunting, and how this approach has hindered the effectiveness of security teams. After Sqrrl was acquired by Amazon Web Services in 2018, the framework temporarily disappeared, prompting Bianco to reflect on his role in its development.
During the session, Bianco spoke candidly about his past mistakes and the need for a more comprehensive approach to threat hunting. He emphasized the importance of research and development in crafting effective frameworks, highlighting the evolution of the field over the last decade. Bianco pointed out that existing frameworks like Sqrrl lacked sufficient guidance on implementation, leading to inefficiencies in hunting operations.
One of the key insights from Bianco’s presentation was the distinction between hypothesis-based, model-assisted, and baseline threat hunting. While Sqrrl focused heavily on data analysis, it fell short in terms of hunting outcomes and strategic planning. Bianco admitted to underestimating the complexity of threat hunting, particularly in overlooking the need for continuous improvement and proactive mitigation strategies.
In response to these challenges, Bianco played a pivotal role in developing Splunk’s PEAK framework, which adopts a three-phase hunting structure: Prepare, Execute, and Act with Knowledge. PEAK offers detailed processes for different types of hunts, along with key steps and activities for each phase. By providing a more structured approach to threat hunting, PEAK aims to enhance the efficiency and effectiveness of security operations.
Another area of improvement highlighted by Bianco was the integration of detection capabilities into threat hunting frameworks. He emphasized the need to not only identify malicious activity but also address underlying vulnerabilities and misconfigurations that can compromise security postures. By leveraging threat hunting as a tool for continuous improvement, organizations can strengthen their defenses and mitigate potential risks proactively.
Furthermore, Bianco underscored the importance of defining tangible metrics for evaluating the effectiveness of threat hunting initiatives. By measuring core indicators such as detections created or updated, incidents opened, and gaps identified, security teams can demonstrate the value of their efforts to leadership and stakeholders. These metrics serve as a benchmark for assessing progress and driving continuous enhancements in security practices.
Since its launch, PEAK has received positive feedback from customers, government agencies, and commercial entities. By providing clear guidance on threat hunting types and metrics, PEAK empowers both novice and experienced threat hunters to navigate the complex landscape of cybersecurity with confidence. Bianco’s ongoing commitment to refining threat hunting frameworks reflects a broader industry shift towards proactive and agile security practices.
In conclusion, Bianco’s reflections on past mistakes and the evolution of threat hunting frameworks underscore the importance of continuous learning and adaptation in the cybersecurity domain. As organizations face mounting challenges from evolving threats like ransomware and vulnerabilities, a strategic and data-driven approach to threat hunting is imperative for safeguarding sensitive information and strengthening security postures. Through initiatives like PEAK, Splunk is paving the way for a more proactive and effective approach to threat hunting in the digital age.