{"id":23893,"date":"2023-02-13T15:00:18","date_gmt":"2023-02-13T13:00:18","guid":{"rendered":"https:\/\/datanets.ro\/datanet-event-threat-hunting-with-cisco-security\/"},"modified":"2025-03-11T19:02:54","modified_gmt":"2025-03-11T17:02:54","slug":"datanet-event-threat-hunting-with-cisco-security","status":"publish","type":"post","link":"https:\/\/datanets.ro\/en\/datanet-event-threat-hunting-with-cisco-security\/","title":{"rendered":"Datanet event: Threat Hunting with Cisco Security"},"content":{"rendered":"

The series of practical events organized by Datanet Systems continued in February with a laboratory dedicated to Threat Hunting operations with Cisco Security tools, a vast field that involves not only a strategic approach but also multiple cybersecurity technologies and solutions. <\/strong><\/p>\n

 <\/p>\n

Supported by Bogdan Ghi\u0163\u0103 and Cristi Marinescu, Presales consultants, the lab included theoretical presentations on the Security Operations Center (SOC)-Threat Hunting relationship and the recommended Cisco solutions, as well as a workshop on an incident investigation with Cisco Security. <\/strong><\/p>\n

 <\/p>\n

\"\"<\/p>\n

 <\/p>\n

Why do we need Threat Hunting<\/strong><\/h2>\n

 <\/p>\n

The reality shows that there are multiple organized cybercrime groups, skilled and with access to powerful technologies, that actively but discreetly work to find and exploit vulnerabilities in the IT systems of targeted organizations. Being practically impossible to cover all attack surfaces, Threat Hunting precisely aims to identify and remove attacks that have penetrated the security perimeter, without attracting attention and triggering alarms. It’s a different approach than traditional security incident investigation, which is triggered after a malicious activity is detected.<\/p>\n

Threat Hunting operations involve multiple techniques of data mining, clustering, grouping, and stack counting, and the results are directly proportional to the data collected, the tools available, and the experience of the investigator. In Threat Hunting, the main objective is not to block the attack, for this, there are already other tools, but rather to understand the context and how an attacker or malware acts inside the network.<\/p>\n

Through Threat Hunting, security teams discover which systems have been affected, if data has been compromised or exfiltrated, if the malware involved will resist remediation measures, or which vulnerabilities need to be fixed to avoid similar incidents in the future.<\/p>\n

Threat Hunting operations have multiple levels of maturity, depending on the degree of routine, in terms of data collection and the level of automation of analysis procedures.<\/span><\/p>\n

\"\"<\/p>\n

 <\/p>\n

At the same time, the Threat Hunting approach differs depending on the providers. For Cisco Security, the “kill chain<\/em>” flow includes several stages, each with associated specific attack and defense elements.<\/p>\n

 <\/p>\n