I ask everyone who starts my Investigation Theory class, "What's a valuable trait or skill for an analyst to have?" Many say "thinking outside the box" And sometimes, unconventional solutions are exactly what’s needed. But the pursuit of novelty can't be an excuse for ignorance of proven doctrine, either. Sometimes we need folks thinking outside the box, but more often, we just need to understand the box better. #DFIR #SOC #CyberSecurity