Welcome to Pluralsight and this Blue Team Tools course
featuring TheHive, the open‑source incident management tool
developed and maintained by Nabil, Thomas,
Saad, Jerome, Danni, and Nils.
During this course,
you will learn how to record security incidents by transforming them
into cases and being able to wrap useful artifacts in them to optimize
your analysis. Examples include phishing indicators of compromise, such
as a file hash or IP address, and drive‑by compromise artifacts, such as
a compromised domain.
You will also have a chance to go over the use of case templates,
which can aid in lowering response times by rapidly recording
cases and determining numerous steps that need to be taken as
a part of an investigation.
This allows for excellent uniformity and thorough responses when
various security analysts work on investigations.
This can be coupled with using different taxonomy references in
addition to the powerful MITRE ATT&CK framework to heavily enrich
instant recording and investigation quality.
And if you think that was it, you are sorely mistaken.
How about all of those useful integrations you can use?
We will go over Cortex Analyzers,
which can help us quickly determine if an indicator is potentially
suspicious and worthy of further investigation.
But the fun doesn't stop there.
Additional integrations include threat intelligence,
as well as automated phishing email analysis using ThePhish.
Come join me to learn how to harness the magic of TheHive
to optimize your security operations and security incident
management and investigations.
No matter if you're a SOC analyst, search responder,
or incident handler, TheHive can help you take things to the next level.