How to be a good analyst from expel.com

https://expel.com/blog/how-to-investigate-like-analyst-expel-workbench-managed-alert-process/

Every analyst should have read these:

The 'Kill Chain' paper

https://lockheedmartin.com/content/dam/lockheed-martin/rms/documents/cyber/LM-White-Paper-Intel-Driven-Defense.pdf

The 'Diamond Model'

http://www.activeresponse.org/wp-content/uploads/2013/07/diamond.pdf