Exam CS0-002 topic 1 question 381 discussion

By aggregating logs in a centralized location with search and filtering capabilities, security analysts can quickly and easily identify anomalous behavior that may indicate a potential threat. Additionally, a centralized location makes it easier to correlate events across multiple systems and identify patterns that may be indicative of an attack.

Source: https://cybersixgill.com/news/articles/4-steps-to-create-an-effective-threat-hunting-roadmap

According to Jason Dion Course establishing a hypothesis is step 1.

You will need to create a hypothesis first before identify anything else. If you go through Jason Dion Course, exabeam article, Trellix/Mcafee article, or even SANS article, it will tell you that hypothesis will be the first step for threat hunting. Look it up.

All Books/authors are saying that the first step in every threat hunting process is to Stablish an hypotesis. The hypothesis serves as a foundational element that helps guide the investigation by formulating a specific assumption or theory about a potential threat.

ChatGPT: When creating a threat-hunting program, the first priority should be to establish a clear and well-defined threat-hunting strategy. This strategy should serve as the foundation for all threat-hunting activities and guide the development of the program. Here are key steps and considerations for building an effective threat-hunting program: Define Objectives and Scope: Clearly define the goals and objectives of your threat-hunting program. Determine the scope of the program, including the systems, networks, and data you intend to protect.

Proactive threat hunting always start in establishing a hypothesis. Source: Jason Dion and Mike Chapple CySA Study Guides

Proactive threat hunting always start in establishing a hypothesis. Source: Jason Dion and Mike Chapple CySA Study Guides

I think D works better with risk assessment, so it is not D. A could be the right answer because Threat hunting is a proactive approach to look for IOC so it starts with hypotheses or anomaly logs helper source: https://www.crowdstrike.com/cybersecurity-101/threat-hunting/

I vote D, even moreso after reading the link Zulu put. Gotta identify what you want to threat hunt instead of wasting time analyzing everything all at once

Answer C