Transition to Risk
On this page
Uncover produced the chain of evidence and the MITRE-tagged narrative. Risk rates how bad it would be if real, how likely it is to be malicious, and how confident the evidence lets us be, then recommends a move: close, escalate, or rescope and keep looking when confidence is too low.
What Uncover hands forward
The evidence package Risk rates. Write it into the timeline (section 2) and evidence chain (section 4) of the handoff-packet.md template; at Level 1 the same items fit in a few lines of the alert report. Six items:
- The evidence chain: what happened, in order, in UTC, each step with its source and confidence label, tagged with ATT&CK techniques where one applies and “none observed” where none does. ATT&CK is an unordered taxonomy, so the sequence is the analyst’s contribution.
- Entity verdicts: which of Scope’s entities were involved, which were ruled out, and which a control contained, each with its evidence.
- Intelligence context: what matched, at what confidence, and whether it was evidence or only a hypothesis source. Attribution carries its own label.
- Coverage gaps: what could not be examined, and why. A gap is written as a gap, never as quiet.
- Detection gaps: techniques no rule flagged, rules that should have been narrower, and the requests filed.
- The hypothesis ledger: every line with its status, refuted ones included, plus the four dry-thread checks for any thread closed on empty results.
What Risk does with it
Risk rates impact if real, the likelihood that the activity is malicious or unauthorized, and analytic confidence on the shared rubric, then turns them into a matrix cell, a priority and a recommended move: close, escalate, or rescope and keep looking. Risk recommends; the Escalation decision makes and records the call. The Risk chapter covers how.
Depth and the close path
Uncover never closes a case. A benign chain (benign-confirmed, or authorized: a benign true positive) goes to Risk with the same rigor as a malicious one, and the documented close is recorded at the Escalation decision. A confirmed criterion is the early exit, from here as from any phase: escalate under the escalation tripwire, and Uncover continues only as IR-assigned scoping support. Level 0 never reaches Uncover. Level 1 narrows it to the one question the verdict turns on. Level 2 gets the full package.
Four ways the handoff fails
Missing confidence labels make the chain look more certain than it is. Silent coverage gaps let Risk recommend a close the late data reopens. Premature attribution survives only until someone questions it. An untagged narrative forces Risk to translate before it can compare. The tags make the narrative portable; they do not replace it.
One handoff, filled in
Case A: a clean Uncover-to-Risk handoff
- Threat Threat Any circumstance or event with the potential to harm the organization's operations, assets, or people (NIST, from CNSSI 4009). The actor behind it is the threat actor; the weakness it uses is a vulnerability. Classical risk models multiply threat, vulnerability, and impact. ASSURED's RATM does not multiply. It scores threat actor intent and exploitation & scope as their own dimensions and lets them inform likelihood, which never rises above what the evidence supports. Risk is then read from the impact-by-likelihood matrix. type: confirmed compromise via a spearphishing link to a paste-and-run lure, with a stolen session replayed into the cloud finance platform.
- Chain: delivery 09:02:11 (T1566.002) → link followed 09:10:05, command pasted into the Run dialog 09:11:40 (T1204.004) → PowerShell cradle 09:11:41 (T1059.001) → transfer 09:11:43 (T1105) → beacon (T1071.001) → cookie theft 09:19:12 (T1539) → replayed sign-in 10:41:07 (T1550.004). All times UTC.
- Confidence per step: delivery and execution high (message trace and EDR, corroborated by the proxy); cookie theft high (EDR process access and file read, corroborated by the 09:19:40 upload in the proxy log); replay high (identity provider, corroborated by the platform’s own log); attribution low.
- Primary entities (confirmed): dlin and laptop-finance-09 (execution: high, EDR corroborated by the proxy); dlin’s cloud SSO identity (replay: high, identity provider corroborated by the platform’s own log); Finance user 2 and laptop-finance-12 (execution: high, EDR corroborated by separately collected PowerShell logs and a matching hash).
- Secondary entities: laptop-finance-09’s machine account (no unusual activity, medium); Finance user 3 on laptop-finance-14 (PowerShell blocked at launch by the EDR’s script-control policy, no execution, high: contained by a control); Finance user 4 (never opened, high). Cloud finance platform: replayed session confirmed, in-app activity unknown.
- Escalation status: escalation tripwire met at 09:24 UTC on criterion 1; criteria 2 and 3 confirmed at 11:05. The page has not gone out, so the first recommendation is to escalate now.
- Regulatory: possible PCI exposure (compliance owns whether the platform touches card data) and candidate GDPR exposure (EU vendor-contact records) flagged in Scope; compliance and the DPO engaged at 09:45.
- Live status: the replayed session was still active on the platform at 13:00. No containment has run; session revocation and platform-side termination wait on the escalation.
- Intelligence Intelligence Information collected and analyzed to answer a decision-maker's question; in a SOC, usually threat intelligence. See Threat Intelligence for its levels and how to grade sources. context: the stage’s hash (the upd.ps1 self-copy) matches one known campaign entry: one indicator, one category, attribution low. The C2 domain Domain Either a DNS name like example.com that identifies internet infrastructure, or a Windows Active Directory domain, the identity and authentication boundary attackers aim to own; context makes the sense clear. As an indicator, a DNS domain's age, registrar, and reputation are among the first pivots in triage. is four days old and does not match prior intel.
- Coverage gaps: cloud finance platform’s in-app activity is in vendor logs, request pending (a gap, not quiet). Hosts off the corporate network and VPN bypass the proxy. Mobile-app activity on BYOD phones is invisible.
- Detection gaps: the rule fired on laptop-finance-09 and not on laptop-finance-12, though both ran the same payload. Cause: the rule’s network leg reads only the web proxy, and laptop-finance-12 was off the corporate network without the VPN. Nothing alerted on a non-browser process reading the browser’s cookie store, or on an existing session used from a hosting-provider address. Feature requests opened.
- Open question for Risk: Is the current scope (5 primary + 3 secondary + 1 SaaS platform) sufficient, or should Risk push back to Scope to widen the sweep to every host that was off the proxy during the window, since the proxy-based sweep cannot see them?
One screen of structured text, every line pointing Risk toward its rating and recommendation, none requiring the SIEM query history.
The benign close (Case B) uses the same format, shifted to what makes the close defensible; the escalation-tripwire case (Case C) is shorter on deliberation and longer on pending items. Both are in the working example.
You are ready for Risk if
- Every timeline row and ledger line carries a confidence label or is recorded as a gap, and every “zero” names the query behind it.
- Risk could recommend a move from the handoff alone, without re-running a query.
Key takeaway
Uncover’s deliverable is a narrative supported by evidence, with explicit confidence and explicit gaps. Done well, Risk’s recommendation is obvious from the handoff alone; done poorly, Risk has to redo Uncover’s work first.
Technical details verified . Product names, defaults and retention change; check your own tenant.