A lightweight starting point for a repeatable analysis record. Adapt it to your environment and the evidence you actually have.
01 / Keep the raw record
Retain original indicators with their source and context. Avoid changes that would make it difficult to reconstruct the observation.
Decode a representation ↗
02 / Create a shareable representation
Use consistent defanging for report copies. Keep the original value and the formatted version distinct in your working record.
Defang the indicators ↗
03 / Review before publishing
Check the formatted results, explain how each indicator was observed, and state the limits of the conclusion. Context makes a list of indicators useful.
Review the formatted output ↗
Keep a structured record
SAMPLE Filename and SHA-256 SOURCE Origin and collection time FORMAT Observed signature and structure OBSERVATIONS What was directly observed LIMITATIONS What has not been examined NEXT STEPS Questions for deeper analysis