Standardized Note Taking Format For Analysts



This post outlines a format for note-taking designed to aid analysts and ensure the knowledge they acquire over time is kept so that it can easily be consumed later. This format is designed to be technology agnostic so it can be applied to a note-taking tool or platform of the analyst’s choice. I designed this format because analysts often received what you could call unplanned information whereby at any given moment during their day they could learn something highly impactful to their role via any medium. This really exasperates the need for good note-taking practices for analysts.

Illustrated above is the wireframe that analysts can implement into their note-taking platforms. Each section contains sub-sections that allow for different knowledge to remain segregated and more searchable.

Meeting Notes

Within any given week analysts can have countless meetings and so it is important to note down items from meetings for future review. Not every meeting needs to be captured but those of importance or those with actions to take should be documented. It’s advisable to note what was discussed, articulated ideas and actions to take. Denoting the date in each meeting note will allow analysts to quickly find previous discussions or actions.

Quick Notes

During the daily life of an analyst, you will likely need to write something down, whether it’s rough notes during an investigation or text you’re preparing to send to someone else. The quick notes section provides a space for this data/information. It’s advisable that any information that you will need to consume at a later date is not kept in quick notes. Quick notes could be compared to a scribble pad.

Tools & Technology

Analysts often have a large breath of tools at their disposal, each with their own complexities as such it is critical that in-depth and well-structured notes are kept on each individual tool. A section for each tool should be created and maintained with relevant sub-sections contained within such as “Query Language”, “Training Resources” etc.


Organizing project work is crucial and as such a section for each project should be kept and maintained. Within each section, sub-sections should be made to allow spaces for different facets of the project. This will change with each project. Personal projects should also be maintained in the same manner providing they are cybersecurity related.


Storing knowledge dedicated to how an analyst may triage or investigate incidents ensures both quality and consistency. As such sections should be made dedicated to topics such as “Investigation Knowledge” and “Process and Procedure”. Within these sections, spaces should be dedicated to items such as different alert types, analysis techniques, investigation theory concepts and runbooks.


Ensuring constant pace and quality while studying is crucial for analysts to remain appropriately equipped for investigations and triage. As such sections should be dedicated to study guides and any goals or objectives for learning established by analysts.


Endpoint on Adrenaline : One

Brilliance in the Basics


Endpoint on Adrenaline 3

Writing detections when stuck with EDR

Endpoint on Adrenaline Two

Investigate Two

Securing your estate: The First Step

Why you need to be purple!