What should you do to automatically convert leads into alerts after investigating a lead?

Question

Hamza BOULHEND · Accepted Answer

Create IOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Hamza BOULHEND · Answer

Lead threats can't be prevented in the future because they already exist in the environment.

Hamza BOULHEND · Answer

Create BIOC rules based on the set of the collected attribute-value pairs over the affected entities concluded during the lead hunting.

Hamza BOULHEND · Answer

Build a search query using Query Builder or XQL using a list of lOCs.

List of questions