Before
Security teams likely had to retrieve recent malware samples, filter suspicious hashes, and search network activity for each indicator manually. When a match was found, analysts had to move between network and endpoint tools, coordinate containment decisions, create prevention indicators, verify detections, and document the actions taken.
How it works
- On a recurring schedule, collect recent malware samples without known signatures and search the network for activity associated with each hash.
- Filter out samples with no observed network hits, then send detailed findings and affected hosts to the responsible team for a quarantine, remediation, or closure decision.
- Apply the approved network or endpoint response, verify endpoint observations where remediation is selected, and update the alert thread with the action owner and timestamp.
Workflow details
- Scheduled threat intelligence collection: On a recurring schedule, the workflow retrieves recent malware samples and filters for samples without a known signature. It extracts the relevant file hashes and metadata for further investigation.
- Network-wide validation: Each candidate hash is queried against Darktrace network activity for the previous 30 days. Results are cleaned, structured, and filtered so that only hashes with observed network hits continue to response handling.
- Actionable incident alerting: When activity is detected, the workflow posts a detailed alert containing the file hash, filename, file type, first-seen information, and affected hosts. The responsible team can choose to quarantine, remediate, or close the incident.
- Human-approved containment: If quarantine is selected, the workflow presents response choices including host quarantine, blocking incoming or outgoing traffic, or enforcing a policy. The selected action is applied to each impacted host through Darktrace, while the human operator retains control over the response decision.
- Endpoint remediation and documentation: If remediation is approved, the workflow creates high-severity custom indicators from the malware hashes with prevention and retroactive detection enabled, then checks for hosts that observed those indicators. Action owners, timestamps, selected responses, and closure status are recorded in the alert thread for follow-up and accountability.
What changed
Threat-hunting runs now occur on a defined schedule and automatically carry each relevant malware hash through network validation, host extraction, alert creation, and response preparation. Analysts still approve the containment or remediation choice, but the selected action, endpoint indicator creation, verification query, and incident documentation are handled by the workflow.
Work removed
Repeatedly collecting recent malware samples, filtering unsigned samples, searching network activity hash by hash, extracting affected hosts, preparing incident alerts, copying hashes into endpoint prevention controls, checking for endpoint observations, and manually recording response actions and timestamps.
Expected outcome
Up to three recurring threat-hunting cycles per week can be completed with consistent network checks, guided human approval, and documented follow-up instead of separate manual searches and handoffs.
