Security Onion 🧅​Jun 25
Chris Sanders 🔎 🧠
If you've taken my Investigation Theory course, then you're familiar with my Human-Centered Investigation Playbooks. I'm excited to share that I'm releasing that standard publicly today. You can read about it here: https://chrissanders.org/2025/06/human-centered-playbooks/
Jun 25 at 6:49pmWeb
Show threadChris Sanders 🔎 🧠Jun 25
Better yet, the folks at Security Onion have integrated the standard into their platform and released a new guided investigation feature today. Every alert in Security Onion will now have linked investigation playbooks you can work from.
Show threadChris Sanders 🔎 🧠Jun 25
Analysts encounter common scenarios (cues) across diverse investigations based on the evidence they encounter and their forecasting of potentially related events. Many of the initial investigative questions analysts will ask in response to these cues can be predicted.
Show threadChris Sanders 🔎 🧠Jun 25
Analysts derive playbooks through inductive reasoning processes. The process is often as valuable as the result. We needed a way to express those cleanly and effectively, supporting analyst cognition.
Show threadChris Sanders 🔎 🧠Jun 25
Playbooks don't replace or restrict analysts; however, they can help them perform more thorough investigations. Creating and using them also serves as an excellent learning tool. I hope this standard and its adoption will help folks along that path. #SOC #DFIR
Show thread13reak Jun 26

@chrissanders88

While I usually agree with your points, I'd like to make a counter point: a lot of people stop thinking when following playbooks.

At work we abolished playbooks in favor of standard operations and procedures combined with checklists. Playbooks only cover certain scenarios (e.g. a ransomware playbook is not applicable for DDoS) while procedures and checklists are general and animate people to think for themselves.

Show thread13reak Jun 26

@chrissanders88

What about issue trees? They are a great resource for covering a problem space without overlap or gaps (MECE).

Show threadAndy Green, Ph.D.   Jun 26
@chrissanders88 you're a good man, charlie brown.