Intelligence-Driven Incident Response

Chapter 8. Analyze

“If you do not know how to ask the right question, you will discover nothing.”

W. Edward Deming

All of the information that you have gathered has been exploited and is now sitting—formatted and standardized—in a database or a threat-intelligence platform. So now what? The information sitting there does little good unless it is analyzed. The Analyze phase of F3EAD is one of the hardest to articulate but also one of the most important. The Analyze phase is where we take data and information and process it into intelligence. This chapter covers the basic principles of analysis, models such as target-centric and structured analysis, and processes to assign confidence levels and address cognitive biases.

The Fundamentals of Analysis

To properly analyze the information you have, you must go through another (thankfully, smaller) version of the intelligence cycle. You need to decide what your requirements are, or in other words, what questions you are going to answer. You need to collect the information that you will use to answer those questions. Most of that collection will come from the information you gathered throughout the investigation and collected and standardized in the Exploit phase, but other information will be needed to enrich or augment that information so it can be analyzed. Therefore, it may be necessary to continue to collect data as you move into the Analyze phase. The Analyze phase of F3EAD captures the entire intelligence cycle, pictured in ...