Field reference
On this page
The chapters teach the questions. These pages are what you look up while answering them: how a given log reads, what a source can and cannot see, which tool family holds the answer, and what a term means. None of them is in the reading order; open the one the case in front of you needs.
Reading telemetry
How to read each source an alert can come from, from formats and normalization to cloud identity logs. Each page covers one kind of evidence, with the fields to read first and the ways it misleads.
- Formats and normalization
- Command line analysis
- Process relationships
- Network correlation
- File system activity
- Cloud and identity logs
These pages sit behind Reading any alert, the nine-step parsing checklist in the Alert chapter.
Sources, tools and sweeps
- Attack chains and correlationCommon multi-stage chains and how single alerts fit into them.
- Telemetry sourcesPer-source cards: what each source records, retention, and its blind spots.
- Tool familiesWhat SIEM, EDR, XDR, ITDR and the other families can and cannot see.
- Identity-persistence sweepThe checklist for any identity an attacker held, per identity provider.
- GlossariesThe method's own terms, plus threat, tool and core analyst vocabularies.