Introduction to Technical Writing

One of the most important skills a SOC analyst must possess is the ability to write technical documents. Let's say you have analyzed an important ransomware case, you did everything as it should be, you identified the root cause of the incident, and took the necessary actions. If you cannot convey this situation to your teammates and management correctly, the process will not be considered complete. Because the rest of the team members could not master the details of the incident due to insufficient communication.

Everyone knows how important communication is in teamwork, so we won't emphasize it again and again. The subject of this training is to develop your skills in written communication. Some important issues to consider when writing a technical article/documentation/report:

• Audience

• Flow

• Intelligibility

Audience

Knowing who will read the content we will prepare is important to determine the details of the content. For example, let's say we are preparing an incident report that the CEO wants to read, your CEO's cybersecurity technical level may not be as deep as yours. Some details that are important to you (MITRE techniques, IOC, etc.) may be meaningless to the target audience. For this reason, it is necessary to create a report that appeals to people.

Flow

Regardless of who will read your report, your report should have a flow. It would not be appropriate to give some information about the end of the Incident and then explain the beginning and create confusion. For this reason, it is necessary to prepare a sequential report with a certain flow. Thus, the reader can create the timeline in his head.

Intelligibility

The sentences we use should be understandable to the reader. We should not complicate the understanding of the report by using complex, inverted sentences.

If we pay attention to these issues in general, we can say that a successful report will emerge.

Why Do We Write Reports?

There is no single reason to create a report. Sometimes due to legal obligations, sometimes due to the request of the administrator, a report can be created. Even if there are no situations that require us as analysts to write a report, we should write a report of the events we examine.

Think of an incident you analyzed two months ago. How much detail can you remember about that situation? Assuming you review dozens of alerts every day, you can't remember much. When a new situation arises about the incident you examined two months ago, you will probably be the person your manager will want to get details from. However, if you do not have a written report or note, it will not be easy for you to respond.

Or imagine making a job change. You have all the information about the analysis you have done, the team has no idea about these situations. Such situations affect the transfer of information within the team in a negative way.

In short, writing a good report is important and must be written for the well-being of both the individual and the team. Although it is often seen as a waste of time and neglected, it provides the solution to many problems that may be seen in the future.