Fingerprinting Attackers With IP Similarity

Coming from the SOAR world, we were always looking for sources that could be used to make better decisions when automating responses or threat hunting. IP similarity now makes it even easier to identify common infrastructure and botnets in order to further hunt based on the data. It also makes it easy to create a blocklist since we know that these IPs have all recently had very similar scan behaviors.

attackers botnets coming data easier easy fingerprinting hunt hunting identify infrastructure order similarity soar threat threat hunting world