Query Focused Datasets
Summary: Dragos describes query focused datasets (QFDs) as pared-down datasets that combine disparate data so analysts can prove or disprove a hypothesis quickly, and says the Dragos Platform ships default QFDs tied to the threat behavior analytics in its content packs. In a worked example, an analyst scoping a ServerStats QFD to assets tied to the Electrum activity group's use of PSExec and "net use" found asset #125337, an SSL server with a producer-consumer ratio of -.99, and a pivot to the certificate QFD showed it using a self-signed X509 certificate.
What you should know: The exfiltration signal in that example was a single field - a producer-consumer ratio near -1.0 on a host that should have been producing - and it only surfaced because the data had already been normalized and correlated before the analyst looked. If your detection stack stops at aggregation and leaves correlation to whoever is on shift, that asset stays a row in a table.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026