TC 3-12.2.4.1 covers the use of data analytics in support of defensive cyberspace operations.
View TC 3-12.2.4.1 on armypubs.army.mil
It contains five chapters and three appendixes addressing analytic support, data engineering, analytic development, execution, data mapping, and analytic techniques. The publication discusses collecting, transporting, processing, analyzing, managing, storing, and retaining data, as well as developing analytic schemes of maneuver and analytic solutions.
Applies to: This publication applies to the Active Army, Army National Guard/Army National Guard of the United States and United States Army Reserve unless otherwise stated.
To have historic data for analysis, there must be persistent, broad-scale logging on the network. (paragraph 1-4)
The analytic scheme of maneuver is the plan to collect and analyze technical data to meet specific information requirements. (paragraph 2-1)
The analytic scheme of maneuver must include sufficient information to direct subordinate units, such as who performs the analysis, data transport and storage, the systems used for collection or analysis, and reporting or follow-on actions required. (paragraph 2-5)
Units must select these carefully, based on their operational context. (paragraph 1-18)
The major analytic support tasks are Training. Capability posturing. Knowledge management. Enduring priorities. (paragraph 5-2)