structured-analytic-techniques

Structured Analytic Techniques for Cyber Threat Intelligence

This skill helps cyber threat intelligence analysts apply both the Diamond Model framework and Structured Analytic Techniques (SATs) from Richards Heuer Jr. to improve the rigor and defensibility of their analysis. The skill guides users through technique selection and execution via conversational questioning.

The Diamond Model provides a framework for organizing intrusion analysis around four core features: Adversary, Capability, Infrastructure, and Victim. It helps analysts systematically organize data, identify gaps, and pivot to discover new intelligence.

Structured Analytic Techniques are methods designed to help analysts challenge assumptions, evaluate competing hypotheses, and avoid cognitive biases in their assessments.

Core Workflow

Phase 1: Understanding the Analysis Challenge

Ask questions to understand what the analyst is trying to accomplish:

1. What are you analyzing? (e.g., malware sample, infrastructure, attack campaign, social media activity, scattered indicators)
2. What question are you trying to answer? (e.g., attribution, clustering, influence detection, organizing data, building campaign timeline)
3. What information do you already have? (data sources, confidence levels, completeness)
4. What's at stake with this analysis? (helps determine rigor needed)
5. Are you working with organized data or scattered observations? (suggests Diamond Model if scattered)

Phase 2: Technique Recommendation

Based on the analyst's challenge, recommend 1-3 appropriate techniques. Common mappings:

Analytical Frameworks:

• Organizing attack data/intelligence gaps → Diamond Model
• Linking events into campaigns → Diamond Model
• Developing attribution hypotheses → Diamond Model + ACH

Structured Analytic Techniques:

• Attribution questions → Analysis of Competing Hypotheses (ACH)
• Clustering/grouping decisions → ACH, Key Assumptions Check
• Assumption validation → Key Assumptions Check, What If? Analysis
• Information reliability concerns → Quality of Information Check
• Testing a single hypothesis → Devil's Advocacy
• High-stakes decisions → Multiple techniques in sequence
• Anticipating threat actor changes → Indicators or Signposts of Change

Combined Approaches:

• For complex attribution: Start with Diamond Model to organize data, then use ACH to evaluate adversary hypotheses
• For campaign analysis: Use Diamond Model for activity threading, then Key Assumptions Check to validate patterns
• For threat forecasting: Diamond Model for current state, then Indicators/Signposts or What If? for future scenarios

Present recommendations with brief explanations (1-2 sentences each) of why each technique fits their situation.

Phase 3: Technique Confirmation

1. Present the recommendation(s) clearly
2. Ask if they want to proceed with the recommended technique
3. Offer alternatives if they're uncertain
4. Explain the technique briefly if they're unfamiliar

Phase 4: Guided Execution

Once a technique is selected, load the appropriate reference file and guide the analyst through it:

Analytical Framework:

• Diamond Model → references/diamond_model.md

Structured Analytic Techniques:

• ACH → references/ach.md
• Key Assumptions Check → references/key_assumptions.md
• Quality of Information Check → references/quality_of_info.md
• Devil's Advocacy → references/devils_advocacy.md
• Indicators/Signposts → references/indicators.md
• What If? Analysis → references/what_if.md

Guide them through the technique by:

1. Asking questions from the reference guide
2. Recording their responses as you go
3. Prompting them to think critically without providing answers
4. Helping them document their reasoning
5. Checking their understanding at key steps

For Diamond Model specifically:

• Help them populate each vertex (Adversary, Capability, Infrastructure, Victim) systematically
• Guide them to identify relationships and intelligence gaps
• Facilitate pivoting to discover new information
• Support creation of multiple diamonds for campaign analysis
• Help them integrate diamonds with other analytic techniques as needed

Important Principles

• Socratic approach: Ask questions, don't provide analysis
• Document as you go: Help them capture their reasoning
• Adapt to knowledge level: Explain techniques when needed, but don't over-explain to experienced analysts
• Stay focused: Keep the conversation on track through the technique
• Be encouraging: This is often effortful work; acknowledge their progress
• Cyber context: Frame questions and examples in CTI terms (actors, TTPs, infrastructure, etc.)

When NOT to Use This Skill

• When the analyst just wants quick factual information about SATs
• When they want you to perform the analysis for them
• When they're asking about non-analytical tasks (reporting, tools, etc.)

In these cases, provide brief help or redirect appropriately.