I’m a proponent of writing things down. As #threatintel analysts, a big part of our job is recognizing patterns and making connections. But sometimes, we don’t see the connections. Our brains can’t recall as much information as we think they can (1/x).
This is why it’s imperative to document and memorialize your knowledge. Use your IOC database, your commercial TIP, OneNote, Excel, Wiki, IR ticketing system, whatever you have to capture artifacts, IOC, notes (2/x).
Tag your data (hopefully you have a consistent tagging scheme); organize it; capture enrichment data and attributes that may allow for future correlation. Does this take extra time? Is it annoying sometimes in the face of an active campaign or IR operations? You bet (3/x).
BUT. It’s an awesome experience when you start examining new activity. “Hmm this doesn’t look familiar.” But you import and organize your data and, Voila! A correlation on past activity! (4/x)
You’ll thank your past self for taking the extra time to capture these details. It’s exciting seeing the patterns that emerge without having to exert the extra brain power to mentally catalogue everything (5/x)
So by “wrote it down,” I don’t necessarily mean a book report. It could be as simple as a handful of IOC, an email header, and a quick note. In some cases you will need more “contextual media” like timelines, queries, screenshots, tables, graphs, etc. (6/x)
In that case, as a best practice, make sure the analyst can navigate from point A to point B. But the take away is document enough to enable future correlation (7/x)
How much and how far to I document? No solid answer here. But the more dangerous the threat, the more time I spend pivoting and capturing that enrichment data (8/x).
In closing, write things down! Your future self (and your colleagues who need your insights) will thank you! #threatintel
