Documentation chapter quiz
Thirteen questions on Documentation. The final chapter of the methodology.
Documentation chapter quiz
No grades. The point is to push your thinking. Select an option to see if it lands.
A closure record reads 'False positive' for an EDR alert that correctly matched a signed IDE helper, running without its sandbox, launching a child that opened an encrypted connection to the vendor's servers. The activity was authorized. What is wrong with the label?
The two axes answer different questions. Detection: the rule matched exactly the behavior it describes, so it is a true positive, not a false positive (logic) or (data). Activity: the behavior was authorized, so the verdict is a benign true positive. Calling it a false positive tells detection engineering there is a logic defect to fix when there is none, and hides why the case closed. 'True positive' alone is ambiguous, because many close codes read it as malicious; record both axes.
A closed record passes every template check: all nine sections are filled and it runs four pages. Each section restates the alert in different words, and nothing in it would help the next analyst work a similar case. Which pitfall is this?
Fields filled, value absent: the template was treated as the goal. A short record that carries the reasoning beats a long one that carries none. Nothing in the record suggests it was written late or holds sensitive data, and restating the alert in other words is padding, not terminology drift.
What is the test of good documentation?
The test is whether the record stands alone: a future analyst, auditor, or trainer can read it and understand both what was decided and why. Timeliness is the most important means to that outcome, since a record reconstructed afterwards rarely passes the replay test. Length and template fidelity are neither the test nor a reliable means to it.
A closed false-positive case is documented. What is its main downstream use?
Closed false positives, well documented, point at where the detection logic could be sharper and help newer analysts learn what to look for. The methodology treats them as contributions, not as non-events.
An investigation checked for persistence mechanisms and found none. Under time pressure, the analyst leaves that check out of the record, reasoning that there was nothing to report. What went wrong?
Omitting negative findings is one of the classic documentation pitfalls. 'Persistence checked: none found, here is what was examined' is what lets a reviewer trust the closure, lets the case re-open without re-doing the work, and defends the analyst if persistence later surfaces through a gap the check could not see. A record that only lists positive findings reads as an investigation that never looked.
An analyst pulls a suspicious binary off a host into a personal scratch directory while working the case, then uploads it to the case-management system at close. What happened to the artifact?
Need a nudge?
What can the analyst prove about the file's history during the scratch-directory stretch?
The chain is the continuous, time-stamped trail from acquisition onward: identifier, acquisition details, every transfer with re-verification, access log, disposal. A personal scratch directory is one of the most common silent breaks: the analyst held the file the whole time, but nothing documents that stretch. A hash at upload proves nothing about the gap before it; the hash has to be recorded at acquisition and re-verified at each move. In practice a gap usually goes to the weight the evidence carries rather than automatic exclusion, but it invites challenge. And custody starts at acquisition, not escalation: if the case might end with IR or external counsel, treat every artifact as evidence from the moment it is collected.
A closure record includes full log excerpts containing customer PII, on the reasoning that the excerpts are the evidence. What does the standard say?
Sanitization mistakes are a named pitfall: a record that copies PII, regulated data, or sensitive operational detail into places that do not need it is complete and a data exposure at the same time. The appendix standard is log excerpts sanitized as needed, with the originals preserved under access control and chain of custody where they belong. Dropping the evidence entirely fails in the other direction, and encryption at rest does not change who can read the record through the system it lives in.
A record reads: 'powershell.exe (parent explorer.exe) started at 09:11:41 UTC on laptop-finance-09, one second after a RunMRU write, indicating paste-and-run initial access.' What does the clarity standard say about this sentence?
The first half is a fact: observable, timestamped, checkable against telemetry. The second half is analysis, a reading of the fact that could change. The standard asks for both, labeled as which is which, so a reviewer can revisit the analysis when new evidence lands without re-litigating the facts. Fused together, a wrong conclusion contaminates a correct observation. Triage records absolutely include analysis (that reasoning is what the replay test depends on), and the voice rule points the other way: active voice, naming who did what.
A closed case record contains a flawless technical timeline and nothing else. Who is left unserved?
The standards page names the readers: the timeline and origin-and-scope sections carry the next analyst, while business impact and lessons learned carry leadership and auditors. A timeline alone gives the next analyst only part of the investigation, and gives an executive, auditor, or trainer almost nothing: no business-impact translation, no decision rationale or approvals, no reasoning that connects evidence to verdict. Each layer is short; what matters is that the record is written knowing that most of its future readers are not the analyst who wrote it.
When in the lifecycle should Documentation begin?
D is the closure gate for a record built continuously from Alert. Observations, decisions, and actions are captured in real time as each phase runs; the Documentation phase is where that living record is finalized into the durable, audit-quality artifact. Delaying the writing until after resolution loses detail and invites post-hoc rationalization, the exact failure the pitfalls page opens with.
A decision header labels the whole case 'High confidence'. The execution chain is corroborated by two independent sources; the attribution rests on a single hash match. What does the confidence rubric object to?
Need a nudge?
How many different claims does this record make?
The rubric's first rule is to label the claim, not the case. A record usually carries several claims at different confidence levels, and one case-level label hides exactly what the next reader needs: here the execution chain is High (direct, corroborated, alternatives ruled out) and the attribution is Low (one indicator). Rounding the whole case down hides the same information in the other direction. And confidence is recorded beside likelihood, not folded into it: likelihood is how probable it is that the activity is malicious, confidence is how well the evidence supports that judgment.
A benign true positive closes on a signed vendor binary. Where and how should the binary's hash be recorded?
Section 06 is Indicators and observables, and every entry carries a disposition: malicious, suspicious, or known-good. A hash filed without that label tends to migrate into the intel platform, a blocklist, or a hunt query, and then every developer running the same signed tool matches a 'known incident artifact.' Leaving it out loses evidence the close rests on, and burying it in an appendix hides it from the correlation that should find it. Recording it as known-good keeps it findable and routes it to the allowlist or warninglist.
A Level 1 case on one ordinary-privilege host closes as benign-confirmed after a 25-minute pass. No pattern entry covers it. The analyst opens the nine-section event report to write it up. What does the template guidance say?
Need a nudge?
Which depth did the case run at, and which artifact goes with it?
Depth decides the artifact. Level 1 uses the alert report, written as you go and finalized at close, with the verdict on both axes and the reasoning behind the close. The nine-section event report is for Level 2 cases and every escalation. The five-field record needs a matching, current pattern entry, which this case does not have. And a bare close code is the 'just a false positive' shrug the methodology refuses: every close, at every depth, leaves a record someone can replay.
Worth revisiting
Technical details verified . Product names, defaults and retention change; check your own tenant.