Certified Incident Handler (CIH) Practice Ecam

In the threat-hunting process, which phase follows 'Collect and process the data'?

1. Investigation

2. Hypothesis

3. Response/resolution

4. Trigger

The correct answer is: Investigation

In the threat-hunting process, once the data has been collected and processed, the next logical phase is the investigation. During this phase, analysts will delve deeper into the data gathered to search for indicators of compromise, anomalies, or potential threats. This involves examining logs, alerts, and other data sources to uncover hidden patterns or evidence that could suggest malicious activity. By conducting a thorough investigation, threat hunters are able to analyze the context of the data, thus enhancing their understanding of the security landscape and identifying threats more effectively. The hypothesis phase refers to the initial assumptions or theories developed before data collection. While it's an essential component of threat hunting, it precedes the data collection phase rather than following it. The response/resolution phase involves taking action based on the findings from the investigation phase, addressing any identified threats, and implementing measures to mitigate them. Trigger generally relates to an event that initiates a specific action or response, and does not represent a phase following data collection in the threat-hunting process.