Improving Cognitive and Collaborative Support for Security Threat Hunters

威胁猎人是一个相对较新的安全分析师职位，在确保加拿大关键企业和政府机构系统和数据的安全方面发挥着关键作用。威胁猎人监控数据、系统和网络的访问方式，以便在系统或数据源受到危害之前了解可能发生的威胁和事件。威胁猎人通常在团队中工作，他们生成假设并主动分析大量系统和网络数据，以检测和隔离可能表明即将发生威胁的异常系统和人类行为。然而，威胁猎人目前使用的工具是在没有很好地了解他们的认知和协作需求的情况下开发的。通过这个合作项目，我们将了解不同类型的威胁猎人角色（他们的能力，动机，目标和协作策略）。利用这些见解，我们将为威胁猎人设计、开发和评估新的工具，以更有效地可视化和分析有关可能威胁的信息，并与其他威胁猎人和关键利益相关者分享他们的见解。 这些见解和工具原型将使我们的合作伙伴组织Micro Focus能够改进他们用于支持威胁搜索的工具和技术。

Threat hunters, a relatively new security analyst position, play a critical role in ensuring the security of critical Canadian corporate and government agency systems and data. Threat hunters monitor how data, systems, and networks are accessed to be aware of possible threats and incidents that may occur before systems or data sources are compromised. Often working in teams, threat hunters generate hypotheses and proactively analyze massive amounts of system and network data to detect and isolate the anomalous system and human behaviours that may indicate an impending threat. However, the current tools used by threat hunters have been developed without a good understanding of their cognitive and collaborative needs. Through this collaborative project, we will develop an understanding of the different types of threat hunter personas (their capabilities, motivations, goals, and collaboration strategies). Using these insights, we will design, develop and evaluate novel tools for threat hunters to more effectively visualize and analyze information on possible threats, and share their insights with other threat hunters and key stakeholders. These insights and tool prototypes will enable Micro Focus, our partner organization, to improve the tools and techniques they use to support threat hunting.