'Give Me Structure': Synthesis and Evaluation of a (Network) Threat Analysis Process...
summary
A four-stage, evidence-focused procedure maps ten detailed information points into four categories—relevance indicators, additional alerts, contextual information, attack evidence—and is evaluated with 10 tier‑1 analysts on 178 real SOC alerts (22 injected) against a 50‑alert ground truth. Analysts trained on the process raise overall correct assessments from 82% to 92% and increase correct escalations for true incidents from 65.9% to 88.6%, making them 2.5 times more likely to flag real threats and yielding measurable analyst performance.
AI-written summary · about
chapters (11)
- 0:00SOCKS and research
- 1:13Tier one challenges
- 2:55Research questions and design
- 3:59Threat analysis info
- 6:04Threat analysis structure
- 7:08Experiment setup
- 9:15Key findings
- 10:43Improved alert accuracy
- 13:51Practical benefits
- 14:55Conclusion and future
- 15:39Q&A
related talks
42mEverything Everywhere All at Once: A Guide to Alert Triage and Analysis
17mIncident Response @ Scale-Building a Next Generation SOC
53mSecurity Operations 2018: What Is Working? What Is Not.
29mDetection Engineering: Defending Networks with Purpose
44mImprove Likelihood Calculation by Mapping MITRE ATT&CK to Existing Controls
38mHow I Learned to Stop Worrying and Build a Modern Detection & Response Program
23mSecurity Tools Don't Detect Attacks—Humans Do
30mThe SOC Counter ATT&CK