ConceptsIdentity Hunting Value

Identity Hunting Value

The principle that identity data is among the highest-value sources for threat hunting, because identity is the modern attack surface, so hunting in authentication and access telemetry catches intrusions that endpoint or network hunting may miss.

Glossary definition

5 direct links6 lessons

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Identity Telemetry

The foundation Identity Hunting Value builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Identity TelemetryStart here

The activity data generated by identity systems, sign-ins, authentication results, privilege changes, access grants, and federation events, that feeds detection, hunting, and investigation of identity-based threats.

lessons

Relatedsorted by lesson coverage

Cloud Hunting Data Sources

lessons

Impossible Travel Hunting

lessons

Identity Anomaly Detection

lesson

Hunter Specialization

lessons

Related Lessons

6 lessons cover this concept

Preparing a Defensible Hunt

SOC Analyst

Living-Off-The-Land Behavior Chains

SOC Analyst

Cloud Control-Plane and Workload Hunts

SOC Analyst

Identity, Session, and Token Hunts

SOC Analyst

Persistence, Memory, and Telemetry Evasion

SOC Analyst

Hunt Program Decisions and Measurement

SOC Analyst