Look at the PEAK framework

[brifordwylie]

Shrug, might be a useful nugget or two... https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html

Let's read this and think about how this might help inform/reflect into our presentation.

[brifordwylie]

Okay, so I reviewed this, I actually found it to be completely relevant to our EDA talk. There's a 'baseline hunting' section which pretty much covers everything we're doing, so I'd like to use that as part of the framing/overview section. @chgath

https://www.splunk.com/en_us/blog/security/peak-baseline-hunting.html