PT0-002 · Question #175
Which of the following would a company's hunt team be MOST interested in seeing in a final report?
The correct answer is B. Attack TTPs. A company's hunt team is primarily focused on proactively searching for threats and needs actionable intelligence to improve detection capabilities. Attack TTPs (Tactics, Techniques, and Procedures) provide detailed information on how an attacker operated, enabling the hunt…
Question
Which of the following would a company's hunt team be MOST interested in seeing in a final report?
Options
- AExecutive summary
- BAttack TTPs
- CMethodology
- DScope details
How the community answered
(19 responses)- A5% (1)
- B84% (16)
- D11% (2)
Why each option
A company's hunt team is primarily focused on proactively searching for threats and needs actionable intelligence to improve detection capabilities. Attack TTPs (Tactics, Techniques, and Procedures) provide detailed information on how an attacker operated, enabling the hunt team to develop better detection rules and improve their overall threat hunting strategies.
An executive summary provides a high-level overview for management but lacks the technical depth a hunt team requires for actionable insights to improve detection capabilities.
A company's hunt team is responsible for proactively searching for threats that have bypassed automated security controls, and detailed Attack TTPs (Tactics, Techniques, and Procedures) describe the specific methods and behaviors an attacker used, which is invaluable for developing new detection queries, improving existing alerts, and enhancing future threat identification.
The methodology section describes how the penetration test was conducted, which is useful for context but does not provide the specific threat intelligence (TTPs) that a hunt team needs to improve threat detection.
Scope details define the boundaries of the test, which is important for understanding the report's context but is not directly actionable intelligence for a hunt team trying to find threats.
Concept tested: Penetration test report content - Hunt Team
Source: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-115.pdf
Topics
Community Discussion
No community discussion yet for this question.