Why context is the new heart of the OSCAR methodology

TL;DR

• Manual collection can’t keep pace with machine-speed attackers, and automation now handles the gathering.
• Swapping collect for contextualize turns OSCAR into a continuous loop, so analysts start at the judgment calls.
• Three other steps shift too: obtain information becomes orient, analyze becomes analyze & validate, and report becomes remediate & record.

Process is what separates disciplined incident response from sheer panic. For years, that operational bedrock in the security operations center (SOC) has been the OSCAR methodology: obtain information, strategize, collect evidence, analyze, and report findings. Analysts put in the reps and sets to ingrain OSCAR as muscle memory.

Yet in an operating environment where adversaries deploy automated tooling and AI to execute attacks at machine speed, the tempo has outpaced the effectiveness of the traditional OSCAR method.

Frameworks break when the operating environment outgrows how they’re executed. For years, the SOC was built around an alert-driven model: an alert fires, and an analyst scrambles to assemble disparate facts from scratch. But when attackers move in milliseconds, that model falls apart.

The future belongs to context-driven security. It’s an operational model where security decisions and alert evaluations are governed by the specific, real-world reality of an organization’s environment (business criticality, identity baselines, and historical precedent) instead of raw telemetry or generic alert severity scores alone.

If our operations must become context-driven to survive, our foundational methodologies have to evolve alongside them. And if you trace the operational friction inside modern SecOps, the logic of OSCAR still holds—until you hit the C.

Should contextualize replace collect? 

When OSCAR was conceived, C for collect made sense as a deliberate, manual phase. An analyst noticed something anomalous, pivoted to the firewall, pulled endpoint telemetry, and checked authentication logs. But by definition, that step was an artifact of the alert-driven era: it was designed solely around gathering raw technical facts, not applying the context required to understand what those facts actually meant to the business. It was sequential, tedious, and human-driven.

Obtain information and collect evidence were always two halves of the same manual job: figure out what you know, then go get the rest. Contextualize hands both halves to automation, so the analyst can start at the judgment calls.

Against adversaries moving at machine speed, manual collection creates three fatal operational bottlenecks:

1. Velocity: Automated attack tooling executes privilege escalation and data staging before an analyst can even log into a secondary console.
2. Cognitive load: Analysts burn most  of their mental bandwidth on swivel-chair analysis, by acting like a human API, copy-pasting IP addresses, hashes, and session tokens across disjointed browser tabs, and draining the critical thinking needed for actual investigation.
3. Accuracy: Manual collection is error-prone as well as slow. Query the wrong host, misread a timestamp or fat-finger an IP, and the evidence you get back says “all clear” when it isn’t. Collecting the wrong evidence is the fastest route to a false negative.

The reality today is that gathering data is no longer the hard part. Modern bots and automated workflows can query endpoints, pull logs, and enrich indicators instantly when an alert fires. Aggregation is a solved engineering problem. The third step no longer needs to be a manual task an analyst executes (collect). Instead, it becomes the operational foundation of context-driven security. C now requires understanding what that collection actually means before taking action: context.

What we mean by context

If we want to fix the C in OSCAR, we have to recognize the difference between what is happening and why it’s happening. Moving from collect to contextualize is what lets an analyst add narrative to the facts of the incident and understand the entirety of a case rather than chasing isolated alerts. It creates room for human judgment at machine speed, keeping pace with attackers in a way collection alone never could.

After watching how the Expel SOC investigates incidents, we found that real context comes from five pillars. Each one answers a different question analysts ask during an investigation:

• Ground-truth metadata: Human and non-human identities, assets, third-party access, open vulnerabilities and visibility coverage describe the environment itself. This answers what exists, and how it’s set up.
• Behavioral evidence: Operational baselines, execution lineage, event timelines and cross-platform attack paths show the story the telemetry tells over time. This answers what happened, and whether it’s normal.
• Threat intelligence: Adversary tradecraft, peer attack trends and network reputation (domain age, hosting ASN, first-seen status) compare your activity against what attackers are doing elsewhere. This answers what attackers are doing out there right now.
• SOC memory: Alert history, past incidents, detection logic and tribal knowledge capture what the team has already learned. This answers what you already know, so your team stops solving the same problem twice.
• Business intelligence: Business criticality, data sensitivity, change tickets, people signals, asset owners and response guardrails tie the event to the organization. This answers what’s at stake, and what you’re allowed to do about it.

The new OSCAR methodology

Replacing manual collection with automated context transforms OSCAR into a continuous decision loop, because each pass through it stops costing your analysts valuable time.

OSCAR was always meant to repeat. Every new lead sends you back to the start, asking what do I know now? But when each pass means another round of console-hopping, analysts run the loop two or three times and call it.

When context lands automatically, a new investigative lead costs seconds. Security analysts can loop as many times as the case needs, and every decision they record becomes context for the next one.

The C is the big change, but it has a ripple effect. Once machines handle the gathering, three other letters shift with it:

• Obtain information → Orient. The information’s already on the table, so the analyst’s first job is to read it and set the goal.
• Analyze → Analyze & validate. When AI assembles the story, the analyst’s job includes checking that story against the evidence.
• Report → Remediate & record. The after-the-fact write-up becomes targeted containment, plus a record that feeds the next case.

Here’s what the OSCAR methodology looks like in the context era: 

Shifting focus from initial access to adversary impact

By automating context, you change where your team spends their brainpower. Responses get faster, and decisions get more accurate.

Those critical early minutes stop going to debates about whether an attacker got past initial access. They go to what matters most: hunting lateral movement, dismantling persistence and shutting down data staging before impact.

The payoff shows up fastest on day one. Anyone who’s onboarded an MDR provider knows the first few weeks are awkward. The analysts don’t know your environment yet, so every odd-looking admin script turns into an “is this expected?” message to your team. (Now multiply that by a few hundred alerts.)

When AI gathers context during onboarding, most of those questions answer themselves. Who owns the asset? What’s normal for that service account? Which change windows are open? The 90-day “learning your environment” phase starts on day one, and you get out of the back-and-forth a lot sooner.

Automating context gives analysts their judgment back. High-speed automation without human oversight is reckless, but manual analysis without automated speed is late. You need both.

By letting AI and automation handle the cognitive burden of context generation, defenders reclaim the operational velocity required to outsmart modern adversaries.