Two in the morning. The queue hands an analyst a host and eleven minutes of its life.
The capture is complete. Process creations, file writes, registry edits, name lookups, outbound connections, a service installation, a scatter of authentication events. Several thousand records, timestamped to the millisecond, none of them missing, none of them wrong. She reads for forty minutes and still cannot say what happened.
This is not a data problem. Nothing was lost. Every action the machine took was written down, and the writing is accurate. What she does not have is a sentence. Something acted, it did particular things, and here is what is different because of it. The record contains that sentence the way a bag of loose type contains a paragraph: all the material, none of the arrangement.
That gap is one of the oldest strange facts in security operations, and it has survived every improvement in collection. We built better sensors and the gap did not close. It widened, because the gap was never really about volume. It is about the distance between a recording and an account.
A problem that looks nothing like this one
Compilers face a version of the same difficulty, and their answer is worth borrowing.
A compiler takes a program written by a person and produces instructions a processor can run. The naive way to do this is directly: read the source, emit machine code. It works, for exactly one language on exactly one chip. Support a second language and a second processor and you now need four translators. Ten languages and ten architectures and you need a hundred.
So compilers stopped doing that a long time ago. A front end reads the source and lowers it into an intermediate representation, and a back end lowers that representation into instructions for whatever the target machine happens to be. Ten plus ten, not ten times ten.
The arithmetic is the boring reason. The interesting reason is that the intermediate representation is where the compiler can actually think. Source code carries its structure implicitly. A loop written three ways in three languages looks like three different things on the page and like one thing in the middle layer, and once it is one thing you can reason about it once. Nearly everything a modern compiler does that is clever, every analysis, every transformation, happens against that middle representation rather than against the text a human typed. The representation is not a compression of the source. It is a re-description of the source in terms that make the properties you care about explicit rather than latent.
Security has the same shape of problem and has largely not taken the same step.
On one side sit the producers: endpoint agents, kernel probes, cloud audit trails, identity providers, network sensors, application logs, each with its own vocabulary and its own idea of what an event is. On the other side sit the consumers: detection rules, statistical models, hunting queries, correlation logic, case management, the investigation screen an analyst stares at, and now language models being asked to draw conclusions. Most of the wiring between those two sides is still pairwise. Each consumer reaches back into raw telemetry and reconstructs meaning in its own private idiom.
Let me be careful here, because the easy version of this argument is false. It is not true that the industry ignores behavior. Behavioral analysis is everywhere and much of it is very good. The question is not whether behavior gets analyzed. The question is where behavior lives, and whether it survives as an object anyone else can read.
The questions a good witness answers
Suppose you did want to build a middle layer for security activity. What would it have to say?
The honest way to find out is to sit next to an experienced responder and write down what they ask. They do not ask for more fields. They ask a small number of questions, in roughly the same order, every time.
Who or what acted? Not merely a process identifier. The whole standing of the thing that did something: which host, which user, which privileges it held, what launched it, whether it lived inside a container or a session, whether it was signed and by whom. This is the subject of the sentence, and an account without a subject is not an account.
What could it do? This one gets skipped, and it is quietly one of the most useful. Capability and use are different facts. A signed backup utility and a binary downloaded ten minutes ago may perform identical file reads; what separates them is everything else each was equipped to do. Recording capability independently of use also lets you ask counterfactuals, and counterfactuals are where investigations often turn. This thing could reach the network and never did. That is information, and it is invisible if you only ever write down what happened.
What did it do? The verbs. Not raw system calls, which are too fine to narrate, and not a summary phrase, which is too coarse to check. The level at which a person would actually describe the activity to another person.
What changed right away? The distinction between an action and its effect is not pedantry. An attempted write that failed is an action with no effect. A single action can produce several effects across several parts of a system. Keeping the two apart is what lets you tell an attempt from an accomplishment.
What stayed changed? This is the responder's real question, and it is the one that decides whether anyone goes back to bed. A temporary file written and deleted at exit is a fact about the past. A scheduled task, a service, a run key, a fresh credential on an account: those are facts about the present. Persistence is the difference between "this happened" and "this is still true", and no amount of timeline scrolling makes that distinction for you.
And how sure are we that we saw any of it? Here the analogy shifts. A security camera records what was in frame and says nothing about what was outside it. A good witness does something a camera cannot: they tell you where they were standing, what was blocked from view, how long they looked away. Most security records behave like tapes. They present what was captured, confidently, and are silent about the frame. So absence of evidence gets read as evidence of absence, which is the most reliable way to be wrong in this field.
Six questions. Read them again and notice what none of them asks. None of them asks whether the activity was malicious.
Why "intermediate" is the load-bearing word
That omission is deliberate, and it is where the word intermediate earns its keep.
The representation stops short of the verdict on purpose. Almost every durable structured object in security operations today is verdict-shaped. An alert is a claim. A case is a claim with paperwork. A score is a claim with a decimal point. There is nothing wrong with claims, but when the only thing that persists in structured form is a claim, two things follow. Everything downstream inherits the assumptions of whichever detector made it. And everything that did not rise to a claim stays in the raw pile, unavailable, waiting to be reconstructed by hand at two in the morning.
The second half of the word matters as much. An intermediate representation is defined by not being owned. In a compiler, no single optimization pass owns the middle layer; that is precisely why a dozen passes can operate on it. A behavioral representation is worth building only if a rule engine, a statistical model, a hunter writing a query, a correlation graph and a machine reasoning system can all read the same object and none of them has to agree with the others about what it means. The moment such a layer becomes the private format of one detection technique, it has stopped being intermediate and has become that technique's internal state.
There is a quieter benefit too. Meaning that is derived once and stored can be revisited. Activity that looked unremarkable in June can be re-examined in August, when new intelligence arrives, without anyone re-deriving the account from raw logs a second time. Whether that plays out in practice is an engineering question and a measurement question, not a rhetorical one. But it is the kind of thing the shape makes possible.
What is genuinely hard about this
A representation is a set of choices, and every choice throws something away. Anyone who tells you otherwise is selling.
Fixing on six dimensions is an argument that these are the things worth keeping. It is a defensible argument. It is still an argument, and everything that does not fit the frame gets flattened into it or dropped at the edge. That is the nature of the enterprise: you buy legibility with loss.
Then there is the boundary problem, which is worse than it sounds. What is one behavior? A process encrypting forty thousand files is not forty thousand behaviors, and calling it one behavior hides the fact that the first file and the ten-thousandth are not equally interesting. There is no principled answer here, only conventions that turn out to be useful, and every convention you pick leaks into everything downstream that reads the result.
Normalization across platforms carries a similar tax. A registry run key, a launch agent, a service unit and a cloud role assignment are all "persistence" only by analogy. The analogy is genuinely useful; it is also a small lie, and if you impose it too early you destroy exactly the specifics that made the case investigable.
The hardest constraint is more basic. Representation cannot manufacture fidelity it was not given. If a sensor cannot reliably attribute a short-lived network connection to the process that opened it, then a beautifully structured account of that connection is confidently wrong, which is considerably more dangerous than obviously wrong. Structure amplifies whatever it is built on, including error. This is not a hypothetical worry. Attribution of transient activity remains an unsolved engineering problem across the field, and honest work in this area treats it as a permanent obligation rather than a solved step.
And it costs. Detection is cheap partly because it is a filter applied early; you decide quickly that almost everything is uninteresting and stop. Building a representation means doing work on activity before you know which fraction of it will matter, which is most of it, which will never be read. That trade has to pay for itself, and the only way to know whether it does is to measure it. The claim that a better representation produces better decisions is a thesis about design, not a result. It needs numbers: investigation time, pivots taken, root causes correctly identified, context that survives a sensor gap. [Comparative measurements — to be added when benchmarked.]
Where the research sits
The idea sketched above is not improvised. It comes out of published work on behavioral representation for cybersecurity, which formalizes those six questions as dimensions of a single structured object; the research goes by the name FACE-EO, and once you have the questions the letters stop mattering.
One thing about its evaluation deserves stating precisely, because the sloppy version of the claim would be worthless. The work was tested against DARPA Transparent Computing data, and what it was compared with were other representation paradigms: event streams, attack labels, process trees, enriched alerts. Families of approach, not commercial products. The reported findings concern representational coverage, the handling of partially observed activity, the distinction between transient and persistent effects, and behavior that remains usable when telemetry is missing. That supports the technical thesis. It says nothing whatsoever about how any vendor's platform performs, and anyone who tells you otherwise is reading a different paper.
What we are building on top of it
DNA Cybertech builds an XDR platform arranged around this idea rather than around it as an afterthought. Telemetry becomes behavior; behavior is what detection, correlation, hunting and investigation read. The behavior layer sits between the sensors and the conclusions, and it is meant to be consumed by more than one thing, which is the whole point of putting it there.
What that is supposed to buy an analyst is narrower and more specific than a slogan. When she opens an incident, the account should already exist: what acted, what it was capable of, what it did, what changed, what is still changed, and where the record has holes. Not a paragraph generated after the fact to describe a verdict, but the structure the verdict was drawn from, navigable in both directions. Whether that reliably shortens a night shift is a question for measurement, and we would rather publish those numbers than assert them.
The ambition is small to state and hard to deliver. Understand the behavior behind the threat. Which begins by writing the sentence down before anyone needs it, instead of asking a tired person to assemble it from loose type at two in the morning.