Defensive Security Analyst

Defensive Security Analyst

When to Use

• Triage security alerts from SIEM, EDR, identity, cloud, network, or email systems
• Investigate suspicious activity and build an evidence-backed timeline
• Tune detections, reduce false positives, or map behavior to MITRE ATT&CK
• Run threat hunts from hypotheses, indicators, or recent incident patterns
• Package findings, IOCs, and containment recommendations for incident command

When NOT to Use

• Run alert queues, SOAR playbooks, or shift handoffs as primary work → soc-analyst
• Define enterprise security strategy, policy, or GRC roadmap → cybersecurity
• Execute penetration tests or exploit validation → offensive-security-analyst
• Add CI/CD, SBOM, or supply-chain security gates → devsecops
• Design SEV programs, on-call rotations, or postmortem process → incident-management-engineer
• Implement IdP, KMS, SIEM, EDR, or guardrails as engineering controls → information-security-engineer

Related skills

Core Workflows

1. Alert triage

Triage in order (first 15 minutes):

1. Validate alert — true positive vs false positive vs benign true positive 2. Scope — single host, user, tenant, or org-wide? 3. Severity — active exploitation vs recon vs policy violation 4. Priority — data class, exposure, privilege level of actor 5. Assign — owner, escalate to IR lead if SEV1–2

See `references/alert_triage.md` for severity matrix and escalation.

2. Investigation and timeline

collect sources → normalize UTC timeline → identify IOCs → map ATT&CK → hypothesis → validate

Primary sources: EDR, auth logs (IdP), proxy/DNS, firewall, cloud audit (CloudTrail etc.), email gateway, DLP.

Timeline fields: timestamp UTC, host/user, action, source log, analyst note.

See `references/investigation_timeline.md` for query patterns and correlation tips.

3. Detection engineering (analyst-facing)

When creating or tuning detections:

1. Define threat behavior in plain language 2. Map to MITRE ATT&CK tactic/technique 3. Specify data source and required fields 4. Write detection logic (Sigma-style or SIEM SPL/KQL) 5. Estimate false positive rate; test on 7–30 days historical data 6. Document response playbook link

See `references/detection_engineering.md` for rule template and tuning loop.

4. Threat hunting

Hunt hypothesis format: "If adversary [objective], we might see [observable] in [data source]."

1. Pick hypothesis from intel, recent incidents, or ATT&CK gap 2. Run hunts across SIEM/data lake 3. Pivot on entities (user, IP, hash, domain) 4. Document negative results (still valuable)

See `references/threat_hunting.md` for hunt cycles and pivot table.

5. Containment and handoff

Recommend containment only with approval per runbook:

Preserve evidence before destructive actions when possible (memory/disk snapshot per policy).

Hand off to IR lead: timeline, IOCs, affected assets, recommended containment, open questions.

See `references/containment_handoff.md` for IR handoff template and evidence checklist.

6. Reporting

Analyst finding summary:

• Executive: 2–3 sentences impact and status
• Technical: timeline, IOCs, root cause hypothesis, evidence refs
• Actions: containment taken, detections added, tickets opened

Redact PII per policy; store raw logs in secure case folder.

See `references/investigation_timeline.md` for report outline.

When to load references

• Alert triage and severity → references/alert_triage.md
• Investigation and reporting → references/investigation_timeline.md
• Detections and tuning → references/detection_engineering.md
• Threat hunting → references/threat_hunting.md
• Containment and IR handoff → references/containment_handoff.md

Alert triage

Table of contents

1. Severity matrix 2. False positive handling 3. Escalation

Severity matrix

False positive handling

Document:

• Detection ID and logic snippet
• Why benign (maintenance window, known tool, expected admin)
• Tuning change (threshold, allowlist scope, enrichment)
• Review date for allowlist expiry

Never global allowlist critical techniques without expiry and approver.

Escalation

Escalate when: executive account involved, regulated data, lateral movement, unclear scope >10 hosts, or legal/comms required.

Containment and handoff

Table of contents

1. Containment checklist 2. Evidence preservation 3. IR handoff template

Containment checklist

• [ ] Incident ticket opened with severity
• [ ] Stakeholders notified per runbook
• [ ] Containment approved by IR lead
• [ ] Actions logged (who, what, when)
• [ ] Monitoring increased on related entities

Evidence preservation

Before reimage or account reset when required:

• EDR snapshot / disk image per policy
• Export relevant log window to case storage
• Hash critical files
• Chain of custody note

IR handoff template

# Handoff — [INC-####]
**Severity:**
**Status:** Investigating | Contained | Eradicating

## Impact
## Timeline summary
## IOCs
## Containment taken
## Open questions
## Recommended next steps
**Analyst:**

Detection engineering

Table of contents

1. Rule template 2. Tuning loop 3. ATT&CK mapping

Rule template

title: [Short behavior name]
description: [What adversary action this catches]
status: experimental | test | production
logsource:
  product: [EDR | windows | aws.cloudtrail]
detection:
  selection: ...
  condition: selection
falsepositives:
  - [Known benign case]
level: medium | high | critical
tags:
  - attack.credential_access
  - attack.t1003

Tuning loop

1. Deploy in alert-only mode 2. Measure FP rate over 14 days 3. Add enrichment (asset criticality, user role) 4. Promote to production with playbook link 5. Review quarterly

ATT&CK mapping

Map each detection to at least one technique ID; identify coverage gaps in ATT&CK matrix for hunt backlog.

Investigation and timeline

Table of contents

1. Log sources 2. Query tips 3. Timeline template 4. Report outline

Log sources

Query tips

• Normalize all times to UTC
• Start narrow (user + 24h window) then widen
• Correlate on session_id, device_id, src_ip when available
• Watch for runas, service account abuse, new OAuth grants

Timeline template

Report outline

1. Summary (impact, current status) 2. Timeline (table) 3. IOCs (hashes, domains, IPs with context) 4. ATT&CK mapping 5. Hypothesis and confidence 6. Recommendations (contain, eradicate, recover) 7. Evidence appendix (log query IDs, screenshots hash)

Threat hunting

Table of contents

1. Hunt cycle 2. Pivot table 3. Hunt ideas

Hunt cycle

1. Hypothesis 2. Data collection plan 3. Execute queries 4. Analyze and pivot 5. Document findings (positive or negative) 6. Create detections or close gap ticket

Pivot table

Hunt ideas

• Rare parent-child process pairs
• New service binaries in user-writable paths
• OAuth apps with mail.read + low user count
• Cloud API keys created then immediate data list