Thread by @chrissanders88

When analysts examine evidence, they are looking for cues that have implications for action. Cues lead to decisions about what leads to pursue or how to respond.

There are several types of cues, but I think novelty cues are one of the most critical. Let's talk about why... 1/

A novelty cue is something that indicates the presence of an unknown threat, capability, or technology that the analyst doesn't understand well. 2/

For example, a novel threat might be represented by an IP address, domain name, file hash, or behavior. If you find these things in a suspicious context and don't know about their origin or associations, they become new and interesting. 3/

Analysts often encounter novel capabilities when a an alert or finding suggests a specific malware or threat actor may be on their network, but they don't understand how that thing typically operates or what it does. 4/

An analyst usually investigates threats and capabilities by reading public threat reports, reviewing sandbox output, performing prevalence analysis, performing various threat intel functions, or conducting malware analysis. 5/

A novel technology is usually software that an analyst knows little about. For example, if an analyst determines an attacker compromised a cloud platform service that they have little experience with (like AWS EC2), that service represents a novelty cue that requires research. 6/

The analyst usually reacts to technology novelty by reading about the tech, setting up a lab to play with it, or consulting someone with that expertise. 7/

That last one is notable... in my research, novelty cues were the most common type of cue to lead someone to ask for help from someone else. We usually recognize that experienced analysts can distill useful information and impart it more quickly than independent research. 8/

Novelty cues often lead analysts to assess threat capabilities, identify relationships, or seek help. The first two are the most common analyst decision goals, and the third most commonly comes from a novelty cue. That all speaks to their importance. 9/

Novelty cues exist relative to experience. That means something that is novel to one analyst may not be to another. Junior analysts will experience a lot more novelty than expert analysts, particularly in terms of capability and technology novelty. 10/

An obvious part of learning to be an analyst is reducing novelty through adding more knowledge about things you might encounter: threat actors, common malware, common services and platforms. The more things you see, the less chance you have to see new things. 11/

Somewhat less obvious is recognizing the common types of novelty you'll encounter and streamlining/automating the process of acting upon it. 12/

That also includes recognizing what information is valuable and what isn't. Your time and attention are limited, so knowing where and how to focus those matters. 13/

If you're inexperienced, everything seems novel at times and that can be overwhelming. It's helpful to not focus on everything that is novel, but instead, on places where you are likely to find novelty that matters and has meaning. 14/

For example, most things in the body of a PCAP look weird because entropy in network data is super high. A lot less things in protocol headers looks weird, and even less in some specific headers. 15/

This means that if you know where meaningful novelty is likely to be found, you can focus on a few specific places within a PCAP. So now, maybe you're looking more at Wireshark columns rather than following TCP streams so much. 16/

Even further, maybe you don't even need the PCAP and you can get what you need from Zeek, proxy, or flow data.

As you understand where meaningful novelty is likely to exist, you dramatically reduce the scope of data that you have to retrieve, examine, and parse. 17/

All analysts rely on novelty cues to compel decisions and actions that move the investigation forward.

Embrace not just the unknown, but where you're likely to find it and how to resolve the repeated types of uncertainty you'll encounter. 18/18