{"id":11910,"date":"2026-11-15T08:30:00","date_gmt":"2026-11-15T08:30:00","guid":{"rendered":"https:\/\/www.cotocus.com\/blog\/?p=11910"},"modified":"2026-11-16T17:30:00","modified_gmt":"2026-11-16T17:30:00","slug":"threatops-audit-checklist","status":"publish","type":"post","link":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/","title":{"rendered":"A ThreatOps Audit Checklist You Can Finish in One Afternoon"},"content":{"rendered":"<p>Here is a working checklist for auditing your ThreatOps practice, built for engineering leads who have an afternoon and a spreadsheet. It is not a maturity quiz and it will not flatter anyone. Each section lists what to look for, the evidence to ask for, and a pass or fail test. The structure follows the ThreatOps entry in the Ops Atlas from xOps School, which frames the discipline as a single operation that merges gathering intelligence on attackers with hunting for them internally.<\/p>\n<p>Before you start, note one caveat the Atlas itself raises: no standards body defines the term, so begin by confirming that your team has written down what it means locally. If nobody can show you a one-paragraph definition, record a fail on line zero and carry on.<\/p>\n<h2>Section A: ThreatOps ownership and scope<\/h2>\n<ul>\n<li><strong>A named owner exists.<\/strong> Evidence: a person, not a team alias, with time allocated. Fail if the answer is &#8220;everyone&#8221;.<\/li>\n<li><strong>Scope boundaries are written down.<\/strong> In the Atlas, round-the-clock alert desks, shipped detection logic, active incident response, weakness prioritisation and log plumbing all sit outside ThreatOps. Evidence: a document naming who owns each of those. Fail if hunts are being used as extra hands for the alert queue.<\/li>\n<li><strong>The handoff rule is in use.<\/strong> A hunt result that holds up should become a request to the team that owns alert rules. Evidence: at least one request filed in the past quarter.<\/li>\n<\/ul>\n<h2>Section B: questions<\/h2>\n<ul>\n<li><strong>Five to eight priority questions are active.<\/strong> Count them. Fewer than five suggests thin coverage; more than eight suggests nothing is being prioritised.<\/li>\n<li><strong>Each question is single-barrelled.<\/strong> One question, one fact needed, one decision supported. Evidence: read three at random. &#8220;Everything about ransomware&#8221; fails; it must be broken into narrower pieces.<\/li>\n<li><strong>Quarterly review has happened.<\/strong> Evidence: dated edits to the list. Fail if the list has not changed in six months.<\/li>\n<\/ul>\n<p>If your team has not done requirement work in this style, our recent article on <a href=\"https:\/\/www.cotocus.com\/blog\/mlops-roadmap-a-complete-guide-for-data-scientists-and-engineering-teams\/\">staged planning for machine learning delivery teams<\/a> shows the sort of stage-by-stage planning that works well for any operational routine.<\/p>\n<h2>Section C: sources and indicators<\/h2>\n<ul>\n<li><strong>A source register exists.<\/strong> Each feed or contact has a reliability letter and a credibility number on the FIRST-style scale. A trusted provider&#8217;s new feed, per the Atlas, starts at A3 rather than top marks.<\/li>\n<li><strong>Every indicator has an expiry.<\/strong> The common sharing format treats the expiry field as optional. Pull twenty indicators at random from your store; if any lacks an end date, fail. The Atlas example lifetimes are fourteen days for IP addresses, thirty for URLs, sixty for domains and a year for SHA-256 hashes.<\/li>\n<li><strong>Blocking is gated.<\/strong> Check the written rule. It should demand top-tier source grades, credibility of 1 or 2, a measured hit rate of ninety percent or better across a three-month window, and absence from allowlists.<\/li>\n<li><strong>Reversal works.<\/strong> Ask the on-call engineer to describe how to undo a block. The Atlas expects anyone on call to be able to do it, with the intelligence owner reviewing within an hour. Fail if only one person has the permission.<\/li>\n<li><strong>Reversals are counted.<\/strong> A monthly number of blocks reverted should exist.<\/li>\n<\/ul>\n<h2>Section D: hunts<\/h2>\n<ul>\n<li><strong>Cadence.<\/strong> About one hunt per fortnight. Evidence: dated notes.<\/li>\n<li><strong>Hypothesis format.<\/strong> Each hunt states actor, behaviour, location and evidence, following the PEAK method the Atlas draws from Splunk, and covers one or two behaviours.<\/li>\n<li><strong>Artefact at the end.<\/strong> Every hunt closes with one of four things: a new-alert request, a ticket for missing data, a flag raised to management, or a note proving the behaviour would have appeared. Fail if any hunt ended with &#8220;nothing found&#8221; and no further note.<\/li>\n<li><strong>Rerun test.<\/strong> Give one hunt note to an outsider and ask for a repeat run. If they cannot, the notes are a diary, not a record.<\/li>\n<li><strong>Data check.<\/strong> Confirm you hold roughly ninety days of the telemetry your hypotheses need. The Atlas decision tree says to fix data first if you do not.<\/li>\n<\/ul>\n<h2>Section E: judgement and language<\/h2>\n<ul>\n<li><strong>Estimative wording is consistent.<\/strong> Standard probability words such as &#8220;likely&#8221;, which maps to about sixty to ninety percent, along with a stated confidence. Never both in the same sentence.<\/li>\n<li><strong>Contested calls use structure.<\/strong> Key assumptions checks and analysis of competing hypotheses appear in write-ups where the evidence is ambiguous.<\/li>\n<li><strong>Attribution is not used as a forecast.<\/strong> Group data from ATT&amp;CK describes past behaviour. Fail any document that predicts next moves from a group label alone.<\/li>\n<\/ul>\n<h2>Section F: sharing<\/h2>\n<ul>\n<li><strong>Handling labels are respected.<\/strong> Check one forwarded message. The Atlas calls out passing amber material beyond clients as an anti-pattern.<\/li>\n<li><strong>Pre-approved classes exist.<\/strong> Decide in advance which kinds of information may be shared without escalation.<\/li>\n<li><strong>Legal basis checked.<\/strong> The Atlas mentions the voluntary sharing article in the European NIS2 directive and notes US protections running to 11 December 2026. Ask your legal contact to confirm what applies to you; do not treat this audit as legal advice.<\/li>\n<\/ul>\n<h2>Section G: metrics<\/h2>\n<ul>\n<li><strong>Outcome ratios are published.<\/strong> Share of questions covered, share of intelligence acted on, hunts that converted and gaps that closed. The Atlas worked example reports 83 percent, 35 percent, 42 percent and 44 percent for an imagined quarter, which is a useful sanity range for a young programme.<\/li>\n<li><strong>Vanity numbers are absent.<\/strong> Indicators ingested, reports produced, hunts started and heat-map coverage should not be headline figures.<\/li>\n<li><strong>Feeds are judged by precision.<\/strong> At least one subscription has been reviewed against measured results in the last quarter. A feed with fifteen percent precision, as in the Atlas example, stays alert-only and is a cancellation candidate.<\/li>\n<\/ul>\n<h2>How to run the audit without starting a fight<\/h2>\n<p>Audits fail socially long before they fail technically. A few ground rules help. Announce that the goal is a baseline, not a verdict. Ask for evidence in the form of files and tickets rather than recollection. Interview the person who does the work as well as the person who owns it, since the two often describe different realities. And agree beforehand that a fail is a backlog item, not a performance note.<\/p>\n<p>Time-box each section to thirty minutes. If a team cannot produce evidence for a line in that time, that is itself the answer, and you should record it as a fail with the reason. Keep the scoring sheet in the same repository as the hunt notes so next quarter&#8217;s audit starts from the last one&#8217;s results.<\/p>\n<h2>Excuses you will hear, and the response<\/h2>\n<ul>\n<li><em>&#8220;We are too small.&#8221;<\/em> The Atlas suggests a repository of plain files as a legitimate start, so size is not a blocker.<\/li>\n<li><em>&#8220;We hunt informally all the time.&#8221;<\/em> Informal looking leaves no artefact, so it cannot be rerun, counted or handed on.<\/li>\n<li><em>&#8220;Our feed provider is reputable.&#8221;<\/em> Reputation is a prior, not a measurement; check precision against your own environment.<\/li>\n<li><em>&#8220;A null result means we wasted the day.&#8221;<\/em> Not if the data was complete. A confident negative is a success; incomplete data is a gap ticket.<\/li>\n<\/ul>\n<h2>Scoring and what to do next<\/h2>\n<p>Count the passes. Treat a section as sound only when every line passes. The Atlas maturity ladder gives a reading: if sections A and B fail, you are at the stage of simply consuming feeds. If A to D pass for two consecutive quarters with at least eighty percent question coverage, you have reached a requirements-driven stage. Sustained hunting with accepted outputs suggests a hunting programme, and an intelligence-led state is where the hunts and the questions steer decisions beyond the security team.<\/p>\n<p>Pick the three most painful fails and put them into a thirty-day plan: owner and questions in the first fortnight, expiry and ratings in the third week, and a hunt with a written artefact in the fourth. If you want to see how another operational discipline justifies its practice choices, <a href=\"https:\/\/www.cotocus.com\/blog\/the-essential-role-of-mlops-in-machine-learning-success\/\">why operational discipline decides machine learning outcomes<\/a> makes a parallel argument from a different field.<\/p>\n<p>The complete reference, including the timeline of frameworks and the myths behind each anti-pattern, sits in <a href=\"https:\/\/www.xopsschool.com\/threatops\/\">the Atlas page for ThreatOps<\/a>. Print the sections above, mark them up in a review meeting, and revisit them every quarter.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A seven-section audit for ThreatOps covering ownership, questions, sources, hunts, judgement, sharing and metrics, with evidence to request and clear pass or fail tests.<\/p>\n","protected":false},"author":37,"featured_media":11911,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[147],"tags":[],"class_list":["post-11910","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>A ThreatOps Audit Checklist You Can Finish in One Afternoon - Cotocus<\/title>\n<meta name=\"description\" content=\"Audit your ThreatOps practice in an afternoon: ownership, priority questions, source grading, hunt artefacts, sharing rules and metrics, each with a pass test.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"A ThreatOps Audit Checklist You Can Finish in One Afternoon - Cotocus\" \/>\n<meta property=\"og:description\" content=\"Audit your ThreatOps practice in an afternoon: ownership, priority questions, source grading, hunt artefacts, sharing rules and metrics, each with a pass test.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/\" \/>\n<meta property=\"og:site_name\" content=\"Cotocus\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-15T08:30:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-11-16T17:30:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-3264008-banner.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"630\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Nikhil Farooqui\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Nikhil Farooqui\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/\"},\"author\":{\"name\":\"Nikhil Farooqui\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#\\\/schema\\\/person\\\/419007bef27e8d85890550d783b96c50\"},\"headline\":\"A ThreatOps Audit Checklist You Can Finish in One Afternoon\",\"datePublished\":\"2026-11-15T08:30:00+00:00\",\"dateModified\":\"2026-11-16T17:30:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/\"},\"wordCount\":1355,\"commentCount\":0,\"image\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-3264008-banner.png\",\"articleSection\":[\"DevOps\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/\",\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/\",\"name\":\"A ThreatOps Audit Checklist You Can Finish in One Afternoon - Cotocus\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-3264008-banner.png\",\"datePublished\":\"2026-11-15T08:30:00+00:00\",\"dateModified\":\"2026-11-16T17:30:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#\\\/schema\\\/person\\\/419007bef27e8d85890550d783b96c50\"},\"description\":\"Audit your ThreatOps practice in an afternoon: ownership, priority questions, source grading, hunt artefacts, sharing rules and metrics, each with a pass test.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-3264008-banner.png\",\"contentUrl\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/b2a-banner-3264008-banner.png\",\"width\":1200,\"height\":630},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/threatops-audit-checklist\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"A ThreatOps Audit Checklist You Can Finish in One Afternoon\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/\",\"name\":\"Cotocus\",\"description\":\"Shaping Tomorrow\u2019s Tech Today\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/#\\\/schema\\\/person\\\/419007bef27e8d85890550d783b96c50\",\"name\":\"Nikhil Farooqui\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g\",\"caption\":\"Nikhil Farooqui\"},\"url\":\"https:\\\/\\\/www.cotocus.com\\\/blog\\\/author\\\/nikhil-farooqui\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"A ThreatOps Audit Checklist You Can Finish in One Afternoon - Cotocus","description":"Audit your ThreatOps practice in an afternoon: ownership, priority questions, source grading, hunt artefacts, sharing rules and metrics, each with a pass test.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/","og_locale":"en_US","og_type":"article","og_title":"A ThreatOps Audit Checklist You Can Finish in One Afternoon - Cotocus","og_description":"Audit your ThreatOps practice in an afternoon: ownership, priority questions, source grading, hunt artefacts, sharing rules and metrics, each with a pass test.","og_url":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/","og_site_name":"Cotocus","article_published_time":"2026-11-15T08:30:00+00:00","article_modified_time":"2026-11-16T17:30:00+00:00","og_image":[{"width":1200,"height":630,"url":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-3264008-banner.png","type":"image\/png"}],"author":"Nikhil Farooqui","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Nikhil Farooqui","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#article","isPartOf":{"@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/"},"author":{"name":"Nikhil Farooqui","@id":"https:\/\/www.cotocus.com\/blog\/#\/schema\/person\/419007bef27e8d85890550d783b96c50"},"headline":"A ThreatOps Audit Checklist You Can Finish in One Afternoon","datePublished":"2026-11-15T08:30:00+00:00","dateModified":"2026-11-16T17:30:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/"},"wordCount":1355,"commentCount":0,"image":{"@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-3264008-banner.png","articleSection":["DevOps"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/","url":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/","name":"A ThreatOps Audit Checklist You Can Finish in One Afternoon - Cotocus","isPartOf":{"@id":"https:\/\/www.cotocus.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#primaryimage"},"image":{"@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#primaryimage"},"thumbnailUrl":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-3264008-banner.png","datePublished":"2026-11-15T08:30:00+00:00","dateModified":"2026-11-16T17:30:00+00:00","author":{"@id":"https:\/\/www.cotocus.com\/blog\/#\/schema\/person\/419007bef27e8d85890550d783b96c50"},"description":"Audit your ThreatOps practice in an afternoon: ownership, priority questions, source grading, hunt artefacts, sharing rules and metrics, each with a pass test.","breadcrumb":{"@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#primaryimage","url":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-3264008-banner.png","contentUrl":"https:\/\/www.cotocus.com\/blog\/wp-content\/uploads\/2026\/11\/b2a-banner-3264008-banner.png","width":1200,"height":630},{"@type":"BreadcrumbList","@id":"https:\/\/www.cotocus.com\/blog\/threatops-audit-checklist\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.cotocus.com\/blog\/"},{"@type":"ListItem","position":2,"name":"A ThreatOps Audit Checklist You Can Finish in One Afternoon"}]},{"@type":"WebSite","@id":"https:\/\/www.cotocus.com\/blog\/#website","url":"https:\/\/www.cotocus.com\/blog\/","name":"Cotocus","description":"Shaping Tomorrow\u2019s Tech Today","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.cotocus.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.cotocus.com\/blog\/#\/schema\/person\/419007bef27e8d85890550d783b96c50","name":"Nikhil Farooqui","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d855702dac00a5af0405bb329101be495718d611233e52c86fe360c8fca6f6dc?s=96&d=mm&r=g","caption":"Nikhil Farooqui"},"url":"https:\/\/www.cotocus.com\/blog\/author\/nikhil-farooqui\/"}]}},"_links":{"self":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts\/11910","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/users\/37"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/comments?post=11910"}],"version-history":[{"count":1,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts\/11910\/revisions"}],"predecessor-version":[{"id":12015,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/posts\/11910\/revisions\/12015"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/media\/11911"}],"wp:attachment":[{"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/media?parent=11910"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/categories?post=11910"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cotocus.com\/blog\/wp-json\/wp\/v2\/tags?post=11910"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}