Typical attribution focuses on ‘whodunnit’ - with little clear benefit to network defenders. This talk will consider attribution by activity and behavior – to develop strategies, playbooks, and responses to types of attack, while leaving nation state attribution to amateurs and reporters.