Campaign Awareness

Campaign awareness is how Backstory decides which findings in an investigation belong to the same intrusion, and which ones only turned up in the same search. One investigation can contain two entirely separate cases, and reporting them as one would tell you that you have a bigger problem than you do.

Why would one investigation contain two campaigns?

Because a single pivot can find things that have nothing to do with each other.

The common way it happens: a rule that catches a technique rather than a family matches both the file you are chasing this week and an artifact from an incident two years ago. Both are real findings. Neither is evidence about the other. Written up as one narrative they become a two year old intrusion that is somehow still active, which is a briefing you would have to walk back.

So Backstory separates them. You get one story per intrusion, each with its own scope and its own recommended actions, plus a note on how they came to be found together.

How does Backstory decide two things belong together?

Only on evidence that would survive a colleague asking "how do you know".

Strong enough to merge two findings into one campaign:

• One file is a variant of the other.
• One file was extracted from the other, or dropped by it.
• Both landed on the same machine close enough together in time to be the same event.
• Both reach infrastructure that is dedicated rather than shared: a rare hostname, or an address that serves almost nothing else.
• Both appear in the same published threat report.

Not enough to merge, and never treated as if it were:

• Both matched the same broad rule. That is how they were found, not evidence they are related.
• Both contacted a common or whitelisted hostname. So does most software.
• Both sit somewhere in the same large cloud or hosting network.
• Both were seen on the same machine, but months apart.

When the evidence is missing, unreadable, or ambiguous, Backstory does not merge. That direction is chosen deliberately: a wrong claim that two things are related sends you down a path that does not exist, and is more expensive than a missed connection you can still find by hand.

What is a lead?

A lead is a hint between two campaigns that is worth your attention and is not proof.

Two campaigns whose addresses sit in the same small block on the same network, for instance, are suspicious in a way that deserves a human look, and not conclusive enough to weld two intrusions together. Backstory reports it as a lead between them, so you get the observation without inheriting the conclusion. If you decide the lead is real, that is an analyst's call, and the evidence for it is already in front of you.

Why does a campaign have to be present in my environment?

Because a campaign is an intrusion in your estate, and something you have never had is not one.

A campaign has to be anchored: either it contains the indicator you started from, or one of its files was actually seen on one of your assets. Relationships among files that exist only in the global malware corpus are real observations, and they are reported as intelligence rather than promoted into a campaign. This matters more than it sounds. Without the rule, two unremarkable corpus files that share a hosting address become a "campaign", and the narrative then describes it as an intrusion you are having.

Do machines belong to campaigns?

No. Machines are locations, not members.

A campaign lists every asset its files were seen on, and the same asset can appear in two campaigns. That means "this machine hosted both", not "these are the same intrusion". If you read the asset list as membership you will merge two cases that Backstory took care to separate.

Where do I see campaigns in the report?

Wherever an item belongs to one, it is labeled with it, and multi-campaign investigations group rather than interleave.

The recommended actions are grouped under campaign headings, with a shared bucket for the cross-cutting hygiene that applies to all of them. The MITRE and kill chain tables group the same way. The connection map is drawn per campaign when the entities split across more than one, so you get one map per intrusion instead of one map of everything.

An investigation with a single campaign renders flat, with no headings and no grouping, because there is nothing to separate. If you never see a campaign heading, that is the answer: one case.

What should I read next?

• The Backstory Report, for the sections these campaign groupings appear in.
• Reading the Investigation Graph, for spotting the separation while the investigation is still running.
• Variants, for the relationship that most often does merge two findings.