Post-Containment Threat Hunting
Hunting after an incident's initial containment to find any attacker footholds, accounts, or activity the response missed, ensuring eradication is truly complete before recovery proceeds.
Concept Neighborhood
Explore this concept’s connections in the groups below.
Start here
Hunt Hypothesis
A related concept to explore, covered by 12 lessons.
Hunt HypothesisStart here
12
lessons
Analyst Development
6
lessons
Containment
5
lessons
Recovery Validation
4
lessons
Containment Validation
3
lessons
Eradication Verification
1
lesson
Show 2 more connections
Related Lessons
6 lessons cover this conceptValidate the Alert and Open the Case
SOC Analyst
Expand Scope and Declare the Incident
SOC Analyst
Coordinate and Verify Containment
SOC Analyst
Preserve Evidence and Assess Sensitive-Data Impact
SOC Analyst
Hunt for Residual Activity and Repair Detection Gaps
SOC Analyst
Recover, Communicate, Measure, and Learn
SOC Analyst
Sign in to open lesson content directly.