Today, I did a thing. After about 10 weeks of analyzing, coding, and testing, I have released SCOUT to the information security community as a FOSS offering for beta testing. Anchored by the personal knowledge management tool, Obsidian, and written in Python, SCOUT aims to be a second brain for Security Operations Center professionals. What is a second brain, exactly?
The concept of a second brain is sometimes credited to Tiago Forte, a productivity expert that popularized the ideas for capturing and indexing information in new and meaningful ways. A second brain is designed to store all of the nuggets of knowledge that you cannot keep in your human brain. Some say it is a dumping ground for stuff you do not want to remember but have accessible. I prefer to think of it as a mechanism that allows the operator to spot patterns and links where it would be otherwise difficult to do so.
SCOUT is an acronym for Security Cyber Operations Unified Tracker. In its most simplistic form, SCOUT is a note-taking application, similar to Cherry Tree, OneNote, Notion, and others. However, unlike folder-based, flat note taking applications, SCOUT brings together the ability to define graph-based relationships, including nodes and vertices, entities and their symbolic relationships. It combines artifact storage with atomic notetaking and cross-entity navigation. The result? Professionals are unlocked from the constraints of a folder-based mechanism and static note silos with relational knowledge structures. The professional preserves operational knowledge as it accumulates.
SCOUT creates the environment that allows an analyst to keep free form notes about a number of entities, including:
- Incidents
- Alerts
- Observations
- Detections
- Standard Operating Procedures
- TTPs
- Telemetry references
SCOUT is the merging of 3 projects: CIPHER (Cyber Intelligence Playbooks, Hunting, Enrichment, and Reporting) for personal knowledge management of Cyber Threat Intelligence entities like threat actors, malware, TTPs, and campaigns. SCOUT (Security Cyber Operations Unified Tracker) for personal knowledge management pertaining to Security Operations, and ITIDs (Incident Type Identification Digits), which is a four-tier taxonomy for incident types.
The SCOUT platform is intentionally designed to work at the micro level, not at the Enterprise level, although notes can be shared, imported, and exported. For instance, a main feature of SCOUT is its ability to track a security professional’s daily shift notes. As you work incidents, the SCOUT Launcher automatically builds a timeline of your activity.
SCOUT, is not a SIEM, a ticketing, or a comprehensive case management system. It does not do detections, and it is not meant to be multitenant by default. Finally, it is not an orchestration platform.
The Problems SCOUT Solves
SCOUT is intended on solving a number of problems that often crop up in security operations teams as it pertains to knowledge management. A tremendous amount of knowledge is lost when using a flat, siloed tool, as there is not a good mechanism to enforce relationships. Therefore, flat-folder solutions are better for archiving rather than pattern recognition and relationship mapping across entities. SCOUT is intended on working in the same manner that a Security Operations professional works: non-linear and across multiple entities. Finally, it distills entities down to their base components, similar to a normalized relational database where each of the components is broken down to its least common denominator. SCOUT then assembles the parts of the whole to tell a story and provide perspective on relationships that may exist in the universe.
How to Obtain SCOUT
Check out my GitHub repository at https://www.github.com/kcyerrid/SCOUT. Also, I recently was a guest on the Detection Engineering Dispatch with Alex Hurtado where we discuss the system.
