HARBOR-17 / 08 / PRACTICE GUIDE
Threat hunting, detection and lessons learned
Move from IOC lists to testable hypotheses. Validate rules against positive and benign negative examples, and turn closure into durable improvements.
Download guide and workpapersOriginal AI-assisted SecNet educational content; examples are fictional. Not a source organization publication or endorsement. Sources checked: 2026-10-21.
EVIDENCE REVIEW DESK
Move from observations to decisions.
Code here is a local policy model with no target connection. Passing model cases are not security approval or device tests.
It is on the list / Incomplete decision
Inspect an incomplete decision based on record existence or another positive signal. Consider denial cases alongside permitted use.
s=>s.iocPresentIOC presence is not current context or attribution. Require source date, behavioral mapping, context and expiry ownership before broadening decisions.
Choices and outputs last only on this open page; they do not update account progress, career status, points or certificates.
01 / EXPLANATION
IOC and behavioral hypotheses
IP/domain/hash lists alone are not durable detection strategy. Record source/date, context, expiry and ownership. Translate behavior into a hypothesis and required data sources. ATT&CK techniques provide analytic vocabulary, not automatic attribution or coverage percentages. Harbor addresses are fictional and must not become real blocklists. Include legitimate maintenance behavior in hypothesis testing.
02 / EXPLANATION
Positive and negative controls
Returning rows does not establish correct alerts. Design known supporting records and benign negative controls, fixing fields, time window and sensor scope. Retest mappings and timestamp semantics when moving rules to another environment. This desk flags same-user sign-ins within ten minutes after a click; it is not a threat detector or production SIEM query.
03 / EXPLANATION
Ownership, cost and review
Assess volume, investigation time, false positives and missed-detection risk together. Missing data is not absence of attacks. Assign a rule owner, escalation path and review date. Connect detection improvements to training, access controls and process changes. At closure, record failed assumptions, added regression tests and residual-risk ownership.
04 / EXPLANATION
Compare Harbor-17 with maintenance
Harbor-17 has a same-user click/sign-in correlation two minutes apart. The maintenance fixture has no click, so no such hypothesis is generated. This proves neither benign maintenance nor malicious Harbor-17, only the narrow rule’s behavior. Test other users, prior sign-ins and events outside ten minutes to expose boundaries. Closure records should carry those limits, data gaps and the next review.
Build the evidence yourself.
Blank workpapers are not completed tests. Fill them in your authorized environment without secrets or real personal data.
Full guide with code, outputs and reasoning ↓Primary references
Explanations are authored by SecNet. References support method and platform context; verify current editions and organizational policy for real use.