Skip to content

Robert M. Lee

Threat Hunting, TTPs, Indicators, and MITRE ATT&CK – Bingo

This blog is a continuation of a fantastic discussion with Richard Bejtlich. He responded to a question online, I blogged about it here and then he responded here and in response to another question I posed here. In this blog I’ll reply to his replies. The main point of this blog to me though is…

Continue reading →

Hunting vs. Incident Response vs. Just Doing Your Job

One of the things that motivates me to write is either being really pissed off or finding someone I really respect and having a different opinion. This blog is about the latter. Richard Bejtlich tweeted (oh the horror) that to him, hunting is just another form of detection. Now his real argument is of course…

Continue reading →