Processes and procedures
When it comes to documentation, the most basic communication to document will be operator tactics, techniques, and procedures (TTPs). These are the day-to-day and minute-to-minute actions that operators and analysts take throughout the life cycle of a threat hunt. To break this down further, think of TTPs like this:
- Tactic: A general concept or way of approaching a problem.
Example: Performing a denial-of-service (DoS) attack against a target.
- Technique: Narrower in focus than a tactic, should include specific mechanisms used to accomplish the required action.
Example: Performing a DoS attack using Low Orbit Ion Cannon (LOIC) on port 80/Transmission Control Protocol (TCP).
- Procedure: Very specific directions, requirements, and toolsets an individual would follow to achieve the desired outcome. These are typically tested, honed, and verified prior to use on client networks.
Example: Step-by-step directions on how...
