So much of what distinguishes good analysts boils down to doing the work and avoiding familiar data bias. Let me tell you about a tangible way I see this manifest. 1/
Let's say you get an alert that some malware might be on a system. There are a lot of ways to investigate, but at some point that becomes informed by the characteristics of the malware itself. 2/
You've detected one characteristic, now you need to confirm more to see if this is a false positive. Or ideally you can disprove it really quickly by the absence of some characteristics. Either way that means RESEARCH. 3/
This usually means doing some Googling, looking at the blogs, checking threat intel sources you have access to, and looking for public sandbox reports. 4/
So many analysts don't do those things. They get stuck in the routine of familiar data bias. They know how to look at PCAP or a software inventory and those things answer lots of questions, so they rely on them exclusively. 5/
At all times, the existing evidence (includes the initial alert) should guide investigative questions. The array of data sources available to you help answer those questions, they don't guide the investigation. 6/
You should not look at the exact same data sources in response to every alert. That indicates you're probably not doing the research work or your org isn't giving you the data you need to be successful. 7/
Aspiring and existing analysts, heed these words. You will gain proficiency and become distinguished by doing the research to allowing you to ask the best questions. It is the defining part of the job but it doesn't some without effort and practice. 8/
Managers and organization support, heed these words. You will better achieve your defense goals and retain more of your folks if you praise them for doing the effortful reasoning work and engineer tooling/data access to support it. 9/
All that research for individual cases and alerts snowballs over time. It builds a monumental library of heuristics that make future work easier and enables deeper insight. These are the things that define expertise. 10/10
