Swarmchasing Report a swarm

Adopting the method

On this page
  1. What to take
  2. Steps
  3. Stating conformance
  4. Sharing rules and results
  5. Comparing with other groups

Specs index

This page is for a group that wants to apply swarmchasing with its own data, tools or reporting, and be comparable with others who do. It lists what to take, what to state, and how to show that the result follows the method. Nothing here needs this repository's toolkit; the toolkit is one implementation.

What to take#

PartTake it asWhere
The methodThe Field Manual, cited by version and section id.Field Manual
Indicator rulesA rules file in the SC-Rules v1 format, this project's or your own.SC-Rules v1
Incident recordsOne SC-Incident v1 document per published incident.SC-Incident v1
Threat-intelligence exportThe STIX 2.1 profile and its x-sc-agent-run object.FM-12.1, FM-12.2
EvaluationThe three kinds of evaluation and what to publish with a number.FM-9.1, FM-9.9
A benchmarkAn SC-Bench file: record ids, labels, derived features and split, never restricted content.FM-9.10, schemas/sc-bench-v1.json

Steps#

  1. Pass the passivity test for every source you collect from, and record each source's terms (FM-3.2, FM-3.4). This is not optional: a group that reads agents' channels or fetches their URLs is not following the method, whatever else it does.
  2. Use a rules file that validates against schemas/sc-rules-v1.json, with a version. If you run your own engine, pass the conformance vectors with the rules version they name.
  3. Grade, link and assess separately. A tier, an agent grade, a scope finding and a coordination finding are four results (FM-15.1). Report each you made, and say which you did not.
  4. Attribute by layer and ladder, with labels, tags and the likelihood table (chapter 7, chapter 8). Keep the competing-hypotheses worksheet with the case (FM-7.12).
  5. Disclose before publishing, on lead times fixed in advance (indicators first, the names of affected parties later) (FM-10.2), and publish notices that withhold what enables harm (FM-11.4).
  6. Measure before you claim. Quote precision only from held-out or prospective evaluation, with its interval and context, and choose public words by the calibration rule (FM-9.12).

Stating conformance#

A report, paper or notice that follows the method says so in one line, with its departures:

Method: SC-FM 1.1. Rules: SC-Rules v1, rules version <version>. Departures: FM-9.3 (no held-out split; regression numbers only).

Name each section you depart from and what you did instead (how to cite). A departure stated is a method followed; one hidden is not.

Sharing rules and results#

  • Rules. A rule you share carries its public basis, its labelled positives and hard negatives, and its before and after numbers (FM-4.7). To contribute one to this project, see writing rules.
  • Tags you publish. When your report quotes a run tag or marker, other groups add it to their published-tags list, and it stops being a hard link everywhere (FM-14.5). Quote only what readers need.
  • Fleet identifiers. Refer to another group's fleet by its identifier, and record the overlap as a soft link until the evidence for a merge is reviewed (FM-5.13).
  • Corrections. When you correct a finding another group cited, tell them; corrections are appended, never rewritten (FM-2.6).

Comparing with other groups#

Two findings compare only when they share the rules version, the unit (record or cluster) and the evaluation kind. Tier names match the Transluce release, so labels compare directly; most other terms map through chapter 16 and the crosswalk in FM-12.4.

Source: docs/specs/adopting.md