Introducing… The Threat Hunter’s Cookbook!

Security August 06, 2025 Ryan Fetterman , Sydney Marrone

Key Takeaways

The security experts on the SURGe team have released The Threat Hunter’s Cookbook, a hands-on guide for security practitioners that features actionable insights into threat hunting methods, ready-to-use queries, and more.
SURGe will be signing limited-edition hard copies of the book during Black Hat.
Those interested in learning more about The Threat Hunter’s Cookbook can hear from the authors during an upcoming live webinar and at .conf25.

Welcome, Chefs! Today we are excited to announce the release of The Threat Hunter’s Cookbook: a practitioner’s guide to learning, expanding, and applying your analysis repertoire for threat hunting. In this kitchen, our main ingredient is data!

Take the Next Step in Your Threat Hunting Journey

Based on the work of dozens of experts across Splunk, and written by the co-creators of The PEAK Threat Hunting Framework, this book is meant to help you take the next step in your threat hunting journey by addressing the black box of the ‘analysis’ step in your workflow. The book organizes and provides transparency to threat hunting methods — like “searching and filtering,” “sorting and stacking,” “clustering,” “grouping,” and more — through a fun, cookbook-style publication, ripe with cooking metaphors, Chef’s Pro Tips, and (hunting) recipes!

With so many ways to kick off a hunt, it can be hard to select the best approach. And even if you have tried-and-true ways for hunting, this can ultimately cap the ceiling of your potential results — and limit the chance to select the best approach for the hunt.

In addition to providing an organization and overview of the top hunting methods, The Threat Hunter's Cookbook features built-in guides, which tie back to our PEAK terminology, to help you select the optimal approach for every hunt.

From there, we offer specific recipes that take on a problem-solution-discussion format to help you learn, apply, and understand the fundamentals needed to become an SPL master chef.

Get Your Copy of The Threat Hunter’s Cookbook

As we’ve learned from PEAK (winner of the 2024 SANS Difference Makers award for Innovation of the Year), hunting is key to driving the continuous improvement of your knowledge, and in turn, your security. More creative and effective hunting is the way to accelerate and optimize this process — so don’t wait any longer, let’s get cooking!

To get started, download a copy of The Threat Hunter’s Cookbook, and if you can, join us at one of our special Cookbook events! We’ll be:

Signing limited-edition hard copies of the book at Black Hat on Wednesday, August 6 from 4:30 - 5:30 p.m. PT at the Splunk Booth (#3046) and from 6:30 - 9:30 p.m. PT at the Splunk AfterParty at Allegiant Stadium.
Talking more about our motivation for writing this book and how you can leverage it as a resource during a live webinar on August 27 and a breakout session at .conf25.

Bon appétit, and happy hunting!

Style

two-column

REvil Ransomware Threat Research Update and Detections

Security

8 Minute Read

REvil Ransomware Threat Research Update and Detections

On July 2, 2021, REvil group used Kaseya to distribute malware to its on-premises customers. Splunk has pushed out guidance to help understand and detect REvil. Learn more about the REvil ransomeware group, their tactics, and how to detect them using Splunk.

Identifying BOD 23-02 Network Management Interfaces with Splunk

Security

2 Minute Read

Identifying BOD 23-02 Network Management Interfaces with Splunk

Splunker Drew Church explains the CISA-released directive to reduce risk from internet-exposed management interfaces, highlighting the threat of external remote services.