Question

During a hypothesis-driven hunt, a SecOps threat hunter pulls a Google Threat Intelligence (GTI) collection containing roughly 4,000 suspected C2 IP addresses associated with a commodity loader campaign. A UDM search for network connections against this set returns 62 distinct internal hosts matching various IPs across the last 30 days. With limited time before an incident review, the hunter must decide which matches to investigate first. Which approach best prioritizes the matches while minimizing wasted effort on likely false positives?

Accepted Answer

Filter the matches to those where the GTI indicator carries a high mandiant confidence/severity score and the destination IP has low prevalence across the enterprise, then investigate those hosts first

Answer

Investigate the 62 hosts in order of the internal IP address ranges, starting with the lowest subnet, since deterministic ordering ensures full coverage

Answer

Discard any match where the destination IP is contacted by more than one internal host, because widely contacted IPs are almost always legitimate infrastructure

Answer

Re-run the search over a 24-hour window only, since anything older than a day is no longer actionable for the incident review