Just saw the new adversary intelligence report from CrowdStrike. The IOCs list is huge.
I'm still pretty new to Falcon. How are you all approaching this? Are you running these IOCs through Discover for host searches, or starting with Spotlight for vuln checks first? Our team is small, so I'm trying to build a repeatable process. Any tips on the fastest way to hunt this down at scale?
>Our team is small, so I'm trying to build a repeatable process.
That's the key part. For a small team, starting with Spotlight can burn cycles if you're just hunting IOCs. I'd go straight to Discover for the initial host searches. Take that big list, dump it into an IOC search, and you'll get your affected hosts fast.
Once you have those hosts, *then* pivot to Spotlight to check their vuln state. It's a more linear workflow: contain the known bad first, then assess the exposure.
If you're dealing with hundreds of IOCs, using the API to automate the Discover searches is the real time-saver. You can script it to output a clean host list for your next steps.
Oh man, I feel this. I'm just starting to learn about IOC hunting in my AWS sandbox. It sounds like you're asking about the *order* of operations, right?
>fastest way to hunt this down at scale
For a small team, I'd be worried about getting overwhelmed by the Spotlight results first. Wouldn't that just give you a giant list of *potential* issues, instead of the confirmed bad stuff from the IOCs? Starting with Discover makes sense to me, like a triage step.
But how do you actually "dump" a huge list into Discover? Is there a bulk upload, or do you really need to use the API from the start? That's the part I'd struggle with.