💼 DFIR for Cisco Talos Incident Response. Thoughts are my own.
📝 Blog: https://chocolatecoat4n6.com/
| Blog | https://chocolatecoat4n6.com/ |
| Github | https://github.com/chocolatecoat/ |
| https://twitter.com/CyberCoat | |
| Threads | https://www.threads.net/@chocolate.coat |
Extremely excited to announce I will be presenting at @CypherCon in Milwaukee, WI in just a few days! Hoping to see some of you there and would be honored if you attend my talk. I will be talking through the ADAPT framework and investigation steps to use within DF/IR.
https://cyphercon.com/speaker/analysis-without-paralysis-mastering-the-art-of-investigation/
After years of experience, trial & error and research, I finally put together my framework for analysts (IR, SOC, IT, if you investigated technical data this is for you).
🐙 ADAPT (Approach, Discovery, Association, Profile, Timeline)
I’ve always felt like there was a gap to teach analysts how to investigate no matter the evidence. No scenario specific playbook, no AI, no limited workflow only intended for niche evidence and no marketing wording that is difficult to interpret when the stress is on.
I know it’s not perfect, but I hope this provides the community something to work from, based on my years of IR experience. I am always open to feedback, changes or even something that might just need to be removed. If you try it out, I’d love to get your thoughts!
Over the last year I've been sharing a framework and mindset for how to perform an investigation as an analyst during Incident Response.
I hope this serves as a great introduction to ADAPT, more to come!
Over the last year I've been sharing a framework and mindset for how to perform an investigation as an analyst during Incident Response.
I hope this serves as a great introduction to ADAPT, more to come!
After wayyyy too long. I've updated my #DFIR templates for documentation. I've added fictional examples within the docs so you can see a good reference and how it's intended.
🚨Blue Team Con 2025 Talk Alert🚨
Talk Title: Analysis without Paralysis: Mastering the Art of Investigation
Presented by: Terryn Valikodath
See abstract: https://blueteamcon.com/directory/analysis-without-paralysis-mastering-the-art-of-investigation/
Why Learning Through Books is Key in Cybersecurity
📚 Types of Books
☯️ The Tao of Books
🏫 Other Sources of Information
https://chocolatecoat4n6.com/2025/04/09/why-learning-through-books-is-key-in-cybersecurity/
Why Learning Through Books is Key in Cybersecurity
📚 Types of Books
☯️ The Tao of Books
🏫 Other Sources of Information
https://chocolatecoat4n6.com/2025/04/09/why-learning-through-books-is-key-in-cybersecurity/
Cisco Talos
Blue Team Con