Threat Hunting 201: Technique 2 | Stacking & Sorting - Find Rare Anomalies in Datasets | Episode 2 скачать в хорошем качестве

Threat Hunting 201: Technique 2 | Stacking & Sorting - Find Rare Anomalies in Datasets | Episode 2

Hello Hunters! 👋 Welcome to Episode 2 of the Threat Hunting 201 Series! In this episode, we continue our deep dive into practical threat hunting techniques — moving from theory to execution. 🔍 What We Cover: ✅ Quick recap of Technique #1 — Filtering & Searching + Process of Elimination ✅ Technique #2: Stacking & Sorting — how to aggregate, group, and sort data to surface rare and anomalous events ✅ How to chain filtering + stacking to navigate from a scoped dataset to actionable findings ✅ Why stacking ascending = finding the needle in the haystack ✅ How these techniques apply to both threat hunting AND incident investigation ✅ Live SIEM demo using Elasticsearch to show real stacking & sorting in action 🎯 Key Concepts: Unstructured Hunt vs. Structured Hunt Baselining your environment using stacking Rarity-based anomaly detection Query chaining: filter → group by → sort by count DNS + process correlation examples 🧰 Tools Referenced: Elasticsearch / Elastic SIEM, KQL / EQL / Lucene 📚 Threat Hunting 201 Series: ▶ Episode 1 — Practicing Hunt & Fake File Process Execution →    • Threat Hunting 201: Practicing Hunt and Le...   📚 If you're new, start with TH 101: ▶ Episode 1 — What, How & Basics of Threat Hunting →    • Threat Hunting 101 : What, How and basics ...   💬 Drop your questions in the comments — let's discuss! 🔔 Subscribe for weekly threat hunting content:    / @thor-hq   threat hunting, threat hunting techniques, stacking and sorting, anomaly detection, SIEM threat hunting, blue team, SOC analyst, elastic security, KQL, EQL, unstructured threat hunting, process of elimination, threat hunting 201, cyber defense, incident response, threat detection, infosec, cybersecurity tutorial, baselining environment, THOR HQ --- #ThreatHunting #CyberSecurity #BlueTeam #SIEM #ElasticSecurity #ThreatHunting201 #StackingAndSorting #AnomalyDetection #SOC #IncidentResponse #ThreatDetection #KQL #EQL #CyberDefense #THORHQ