After a quick intro to Incident Response (IR), we will raise multiple questions/dilemmas on each of the IR stages/steps for which there is not always a straightforward answer. The objective is to help Responders find the best possible solution when faced with challenging situations, taking into account the specific circumstances of each incident and the general context in which the organization operates.

During this 30-minute talk I will be making an intro to Threat Hunting and describing a 1-month long Hunt for exfiltration with its complexities and lessons learned (redacting some sensitive details). The talk will focus on trying to help other Hunters into avoiding certain pitfalls and encourage new people to jump into the threat hunting field.