Let me start by saying I mean no disrespect to Hercule Poirot or Miss Marple. They are the lure, there is a reason they get top billing. (And while I have never fantasized about being Poirot, I have more than once wished I was Miss Marple.)
Felicity Lemon was Hercule Poirot's secretary, and before that, was employed as Mr. Parker Pyne's. She was described as "unbelievably ugly and incredibly efficient" and looked as though "a lot of bones [were] flung together at random". She was extremely useful to Poirot as being the perfect secretary with hopes of creating the perfect filing system. Her passion for order matched that of Poirot himself. Miss Lemon had a sister who managed a youth hostel in Hickory Dickory Dock.
George (sometimes referred to as Georges) is Poirot's valet, or gentleman's gentleman. He came into the employ of Poirot sometime after Captain Hastings had left for Argentina (after Murder on the Links). Prior to being Poirot's valet, he served for Lord Edward Frampton. George remained the Belgian's valet until the last novel, Curtain. Poirot utilized George as a source of knowledge of the English aristocracy and was described as a "delicate social recorder". George was also an expert at being a "social snob". Poirot always appreciated the thorough accuracy of George's descriptions he used on people. George was described as having a deferential manner and it was said that communication was sometimes involved with difficulties between him and his employer.
A long-time friend of Poirot's, Goby himself was a private investigator who specialized in information--and obtaining it quickly. Few employed him because he was very expensive for his services. He was described in After the Funeral as "small and spare and shrunken. He had always been refreshingly nondescript in appearance and he was now so nondescript as practically not to be there at all." When he speaks to someone, he doesn't look at the person. Goby became more talkative as the years went by, rambling on instead of being focused on the subject of his investigations. He assisted Poirot later after having been hired by the American millionaire Rufus Van Aldin in The Mystery of the Blue Train. The character of Mr. Goby does not appear on screen in any adaptation of the works listed below.
Colin Lamb was a marine biologist helping the Sercret Service when he meets a young woman who finds a dead body. He narrates half the novel The Clocks, giving his own point-of-view of the police proceedings in the investigation of three murders while describing his own adventures into espionage. Apart from being friends with Poirot, he was also acquainted with the mystery novelist Ariadne Oliver. It is hinted in the novel that his father might've been Superintendent Battle, but it is up to the reader to decide. It was Poirot that Colin contacts to help assist him and Detective Inspector Hardcastle in investigating the murder of a Mr. Curry. What is inexplicable, however, is that in the television version of The Clocks, Colin's last name is Race and his father is Colonel Race, seen in the adaptation of Death on the Nile.
As these friendly reminiscences were being indulged in, I drew nearer, and was introduced to Detective-Inspector Japp, who, in his turn, introduced us both to his companion, Superintendent Summerhaye.
Cyber threat intelligence (CTI) is being used to search for indicators ofattacks that might have compromised an enterprise network for a long timewithout being discovered. To have a more effective analysis, CTI open standardshave incorporated descriptive relationships showing how the indicators orobservables are related to each other. However, these relationships are eithercompletely overlooked in information gathering or not used for threat hunting.In this paper, we propose a system, called POIROT, which uses thesecorrelations to uncover the steps of a successful attack campaign. We usekernel audits as a reliable source that covers all causal relations andinformation flows among system entities and model threat hunting as an inexactgraph pattern matching problem. Our technical approach is based on a novelsimilarity metric which assesses an alignment between a query graph constructedout of CTI correlations and a provenance graph constructed out of kernel auditlog records. We evaluate POIROT on publicly released real-world incidentreports as well as reports of an adversarial engagement designed by DARPA,including ten distinct attack campaigns against different OS platforms such asLinux, FreeBSD, and Windows. Our evaluation results show that POIROT is capableof searching inside graphs containing millions of nodes and pinpoint theattacks in a few minutes, and the results serve to illustrate that CTIcorrelations could be used as robust and reliable artifacts for threat hunting.
38c6e68cf9