Direct analysis versus secondary correlation
When a team analyzes data, there are two methods for the data to be analyzed and compared with other events. These two methods are direct analysis and secondary correlation:
- Direct analysis means going directly to the target source for information. If a system is believed to be running a malicious process, an analyst remoting into the system and viewing the running processes would be direct analysis.
- Secondary correlation means going back one step and inferring the state of a target without interacting directly with the target source. An analyst observing network traffic leaving a system and going to a known malicious command and control site would allow them to infer that the malicious code was being executed on the system.
Direct analysis will typically be observable by an adversary if they are looking for it. An analyst remoting into a system and running commands or even looking at the normal system-generated logs are...
