jennifer48 wrote:

What tools are people using these days for threat hunting? Still CrowdStrike or something else?

Our after-action report...

SIEM were updated to remediate known domain. After applying the security update, we confirmed that system weakness is no longer vulnerable. The Red Team recommends implementing protective measures...

Based on number of active threats, the impact of this ransomware was medium compared to expected traffic. That's a really insightful analysis of network monitoring, especially the part about VPN...