Forest Global Training Partners

Cyber Risks · Cisco Talos

Proactive threat hunting with Talos IR

Summary: Cisco Talos describes how its Incident Response team conducts proactive threat hunting using the Splunk SURGe team's PEAK Threat Hunting Framework, built around Prepare, Execute, and Act with Knowledge. The approach combines baseline hunts that document normal user activity, network traffic and system processes, hypothesis-driven hunts that test specific assumptions such as a targeted phishing campaign, and model-assisted threat hunts (M-ATHs) that use machine learning to find deviations from typical patterns.

Key Takeaway: Talos notes that threat actors are adept at blending malicious activity with normal operations, which is why it positions baseline hunts against insider threats, advanced persistent threats and novel techniques that conventional detection misses. For retainer customers, a hunt that uncovers an active adversary can be escalated to Talos's 24/7 on-call Incident Response team for containment and eradication.

Read the original at Cisco Talos ↗

Topics
Detection & Response
Related
YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026