As soon as a threat or vulnerability (such as Log4Shell) is discovered or announced, Team Axon researches the threat and investigates your environment for potential impact and risk by utilizing relevant IOCs and TTPs.
TEAM
Their mission: Help your security team protect your organization, through prompt and reliable cyber expertise.
See them in actionRAPID RESPONSE
How it works:
1.
2.
The team issues an advisory and practical hunting tools to all customers, via email, Twitter, GitHub, blog posts, and the Rapid Response status page.
Advisories include:
- Information about the threat
- Mitigation recommendations
- Hunting queries
- Additional resources
3.
If there’s suspicion that you’ve been affected, Team Axon reaches out individually with a full report detailing what happened and next steps.
4.
Relevant detection methods are implemented in the platform, providing immediate coverage against imminent threats and extending future automation to all Hunters customers.
EXPERT INVESTIGATION ASSISTANCE
Whether you need a hand with a particular investigation, or just a second opinion, someone from Team Axon will be there to provide advice and assistance.
Consult an Axon Expert
General assistance and consultation with the Axon team.
This can include topics such as:
- Investigating particular signals or alerts in the product
- Developing hunting queries
- Guidance on new and emerging threats or vulnerabilities
Axon Incident Investigation
If you need help dealing with an incident, Axon is there. Once the investigation has been handled, the team will provide a report with details, incident severity, and actionable recommendations, in an easy-to-digest format
If Team Axon finds a potential attack in your environment, they’ll send you a human-readable report, containing:
- Threat summary
- Risk assessment
- Recommendations and immediate action items
- Thorough timeline and kill chain analysis
- Relevant data sources for hunting
PROACTIVE THREAT HUNTING
Today’s security teams are choosing to take a proactive approach to threat prevention. Team Axon performs periodic threat hunting activities over your environment, helping your team detect and respond to emerging threats that may have been missed by traditional security measures.
Team Axon analyzes raw logs in the “dark corners” of your network where your team isn’t necessarily looking.
If a threat is found, Axon alerts your team and provides a detailed report with best practices and recommendations.
Periodic security posture and hygiene reports help your team stay above water.
Interesting research findings are often published on X (formerly Twitter) or on the Hunters blog.
(Former) Deputy CISO, Cimpress
Is Team Axon an MSSP?
No, Team Axon is not an MSSP. It is an additional service that can be purchased with Hunters SOC Platform to complement your existing team with added threat hunting expertise.
How often do Rapid Response campaigns take place?
Unfortunately, adversaries don’t follow a schedule, but Team Axon makes sure to constantly monitor the news for public announcements of new threats and vulnerabilities.
What sources do Team Axon monitor to keep informed on emerging threats and TTPs?
There’s no defined list of sources the team monitors, but they do track CISA Alerts, MSFT alerts, and other official sources, and follow threat intelligence communities on Twitter and beyond to get ahead of new threats and vulnerabilities.