DEFINING TTPS FROM INCIDENT DATA Monty St John, Director of Intelligence This analytics workshop walks students through on how to derive the use of tactics, procedures and techniques from telemetry and incident data. You will learn to: • Identify adversary tactics employed • Outline procedures and techniques from observations of data • Further separate and break down procedure/techniques into operations