Detection, Investigation and Intelligence Tools

All courses / Tools / Module 4 / Chapter 12

Learning objectives

After the lesson the participant can:

• Draft a detection record with data sources, technique mapping, tests, owner, origin and review date.
• Explain how a case record separates the work of an AI system from what a person checked.
• Write a hunt record that states what was not searched.
• Trace the chain from intelligence record to hunt, detection and case by identifier.

Key concepts

Detection record

An artefact of AI Blue, family DET, that defines a detection with its logic, data sources, ATT&CK mapping, tests, owner and review date. Its origin block names the drafting system and its level, which makes an AI-drafted detection auditable.

Decay estimate

An artefact of AI Purple, family DCY, that estimates how fast detections decay between tests and gives each a state: current, at-risk or expired. The example gives priority detections a 90-day expiry and others 180 days.

Case record

A record, family CASE, of evidence, queries, reasoning and who or what reached each conclusion, so the case is reproducible. It separates the AI's work from the analyst's and keeps a list of corrections.

Hunt record

A record, family HNT, of a hunt's hypothesis, data, queries, result and coverage statement, with a conversion target: a detection identifier or a repeat date. Its most important field says what was not searched.

Grounded triage record

A JSON record from AI Red Team of an AI triage verdict tied to evidence. Its not_established field records the absence of evidence instead of leaving a fluent gap, and a field for the analyst's decision is left empty.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Teaching plan

Discussion

1. The chapter concludes that a passing test has a half-life. What events in your estate should put a detection in the at-risk state before its clock runs out?
2. Why does the series set Level 1 Assisted as the default for AI in detection change and not use Level 4 Autonomous for detection logic?
3. An intelligence record keeps the attribution a reviewer rejected. What is the value of recording rejections as well as accepted items?

Written exercise

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

1. What does the hunt record's coverage statement add that a result alone does not?

   1. The number of analysts who took part in the hunt
   2. The cost of the queries in the data platform
   3. A statement of what the hunt did not search
   4. The supplier of the telemetry that was used
   Show the answer

   C. A statement of what the hunt did not search
   A hunt is recorded with what it did not search; the chapter calls this the most important field of a record that another hunter can review and repeat.

2. Which chain of identifiers does the chapter call the series' most useful lead for showing an auditor how a detection came to exist?

   1. SVC to SLO to RST to CHG to DRF
   2. SCN to EMU to FND to REG to COV
   3. RISK to EXC to AIDR to MAP
   4. INTEL to HNT to DET to CASE
   Show the answer

   D. INTEL to HNT to DET to CASE
   The Summary states that the records chain by identifier, INTEL to HNT to DET to CASE. The other chains belong to operations, the purple loop and governance.

3. What is the limit of the series' claim about KEV, EUVD, EPSS and SSVC?

   1. None of them is a verdict; they inform a prioritisation decision and are used in combination
   2. Each of them alone decides the patch order for a critical service
   3. They apply only to AI systems and not to conventional software
   4. They may be used only by financial entities in scope of DORA
   Show the answer

   A. None of them is a verdict; they inform a prioritisation decision and are used in combination
   The chapter says none of these is a verdict: the vulnerability sources inform a decision and do not make one, and they are used in combination, not alone.