Analysis is the step that turns collected data into intelligence. Raw indicators and reports mean little until an analyst interprets them, weighs their reliability, and draws conclusions that a decision maker can act on. Tradecraft is the body of method and discipline that keeps this interpretation rigorous rather than intuitive. Good tradecraft makes reasoning transparent, exposes assumptions, and guards against the natural tendency to see what we expect to see. It also makes judgments reproducible, so that another analyst reviewing the same evidence can follow how a conclusion was reached and challenge it where warranted.

The core elements of analytic tradecraft covered in this area include the following.

• Structured analytic techniques: repeatable methods such as analysis of competing hypotheses and key assumptions checks that impose discipline on reasoning.
• Hypothesis generation and testing: building multiple explanations for an observation and seeking evidence that would confirm or refute each one.
• Cognitive bias mitigation: recognizing anchoring, confirmation bias, and mirror imaging, then applying techniques that counter them.
• Attribution analysis: assembling technical, behavioral, and contextual evidence to associate activity with a threat actor while acknowledging uncertainty.
• Confidence and estimative language: expressing judgments with calibrated terms so that readers understand how strongly a conclusion is held.

References#

• Richards J. Heuer Jr., Psychology of Intelligence Analysis
• MITRE ATT&CK, attack.mitre.org