02 / 08 of 8
Courage
pronounced yoo
Domain: Threat hunting and incident response
Do not wait for the arrow. Go and find the archer.
Act when the evidence is incomplete.
An incident rarely announces itself with certainty.
A detection may be weak. A system may behave strangely. A user may report something that cannot yet be reproduced. Waiting for proof can give an attacker time.
Threat hunting exists because detection is incomplete. Incident response exists because waiting for perfect information is not an option.
Courage in security means investigating the uncomfortable possibility, escalating when the evidence warrants it and taking action before every question has been answered.
A SOC that only ever responds to alerts it configured itself.
When Yu is absent, teams wait for certainty. Analysts close unusual alerts because they cannot prove malicious activity. Architects avoid challenging projects. Incidents grow while everyone waits for someone else to act.
Make the behaviour explicit and repeatable.
Define escalation thresholds
Give analysts clear conditions under which suspicious activity must be escalated.
Run basic threat hunts
Regularly investigate behaviours that existing detections may miss.
Establish incident authority
Define who can isolate a device, disable an account or block traffic during an incident.
Create challenge points
Require security review for architectures and changes that introduce material exposure.
Document uncertainty
Allow incident teams to record hypotheses as hypotheses instead of forcing premature conclusions.
Embed the behaviour into processes and ownership.
Exercise incident response
Run tabletop and technical exercises where information is deliberately incomplete.
Maintain hunting hypotheses
Turn intelligence, incidents and unusual telemetry into repeatable hunting questions.
Define containment playbooks
Pre-authorise common containment actions so teams do not need to negotiate authority during an incident.
Establish independent escalation
Allow analysts to escalate significant concerns without requiring approval from the team being investigated.
Protect useful challenge
Create a process for challenging high-risk decisions without turning disagreement into personal conflict.
Verify that the behaviour is happening and that it works.
Measure detection-to-investigation time
Track how quickly suspicious signals receive meaningful investigation.
Measure investigation outcomes
Record how many hunts produce new detections, vulnerabilities, compromised assets or useful negative findings.
Test blind spots
Periodically simulate activity that existing detection rules should not identify.
Review closed alerts
Sample alerts closed as benign and test whether the reasoning was sound.
Track delayed escalation
Identify incidents where evidence existed but action was delayed.
Use evidence to improve the behaviour and respond to change.
Turn hunts into detections
Convert repeatable hunting discoveries into automated or semi-automated detection.
Feed incidents into architecture
Use recurring investigation findings to change identity, network, endpoint and application design.
Rehearse decision-making under pressure
Run exercises where business impact and incomplete evidence compete for attention.
Challenge detection assumptions
Regularly ask what the SOC cannot currently see and what an attacker could do without generating an alert.
Reward justified intervention
Recognise analysts and engineers who escalate credible concerns early, including cases that ultimately prove benign.
The SOC sees an administrator authenticating from an unusual country.
The login technically passes MFA.
The analyst does not close the alert because "MFA succeeded."
They investigate the device, authentication history and subsequent activity.
The account turns out to have been compromised.
Courage means investigating the signal that does not fit the expected story.
EDR reports suspicious PowerShell activity on a finance workstation.
The user is a senior employee and claims they were running a legitimate script.
The analyst investigates anyway.
The script contains an encoded payload downloaded from an external server.
Security investigations cannot depend on someone's position or confidence.
There is no alert indicating credential theft.
The security team hunts for unusual authentication patterns across privileged accounts.
They discover several service accounts authenticating interactively.
No existing detection rule identifies this behaviour.
The investigation finds compromised credentials.
Threat hunting searches for what the controls have not already found.
A ransomware incident affects a regional site.
The business wants systems restored immediately.
The incident commander refuses to reconnect compromised hosts until containment and credential reset activities are complete.
The decision delays recovery.
It also prevents the attacker from regaining access through the same credentials.
Courage sometimes means accepting short-term operational pain to prevent a larger failure.
A new application is being deployed with direct access from the internet to an internal database.
The project is already late.
The security architect challenges the design and requires an intermediary service and restricted network path.
The project team is unhappy.
The exposure is removed before deployment.
Courage means being willing to stop a bad decision before it becomes an incident.
Reading: An honest tension: both frameworks mandate detection, but proactive hunting beyond configured alerting is largely beyond what either requires — and that gap is the virtue.
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| DE.CM-01 | Networks and network services monitored | direct | Continuous monitoring is the platform courage builds on, though the framework stops short of mandating the hunt. |
| DE.AE-02 | Potentially adverse events analysed | direct | Analysing adverse events is the disciplined core of threat hunting that both frameworks do require. |
| RS.MA-01 | Incident response plan executed | direct | Executing the response plan is acting decisively on what the hunt turns up. |
| Control | Control title | Strength | Why it maps |
|---|---|---|---|
| A.5.7 | Threat intelligence | direct | Threat intelligence is the raw material for going to look for the archer rather than waiting for the arrow. |
| A.8.16 | Monitoring activities | direct | Monitoring activities cover detection but not proactive hunting beyond configured alerting — that gap is the virtue. |
| A.5.26 | Response to information security incidents | direct | Responding to incidents is the courage to engage once contact with an adversary is made. |