Medium-Severity Chain on Quarter-End Close: Isolate or Watch?

Recommendation: contain now, and treat the change freeze as irrelevant to this decision.

Reasoning chain:

• The sequence is a recognised intrusion chain, not a single weak signal: Office macro execution, then rundll32 spawning, then outbound C2-style TLS, then SMB lateral attempts. Three independent telemetry sources agree. The prior probability of a false positive on the full chain is far lower than on any single alert, even though FortiSIEM labels it Medium.
• Blast radius of acting is one finance user losing Excel for an afternoon during close. Blast radius of not acting, if the SMB attempts are blocked only by luck, is credential theft against accounting file servers at the worst possible moment for the business.
• Change freeze governs change-induced risk. Containment reduces risk. Freezing remediation while an active adversary sits on a domain-joined, local-admin host inverts the intent of the policy. Document the exception, notify the finance controller and the change board, proceed.

First 30 minutes:

1. Use FortiEDR network isolation rather than powering the host off. Isolation cuts C2 and lateral movement while preserving volatile memory, running processes, and EDR telemetry that a shutdown destroys.
2. Capture memory and a KFF forensic package before any remediation.
3. Disable the user's AD account and revoke sessions; reset credentials out-of-band, not on the suspect host.
4. Block the destination IP and any resolved domain at FortiGate egress with a temporary, logged policy, so other hosts cannot reach it.
5. Hunt the same parent-child pattern and destination across all 6,100 FortiEDR agents, and query FortiSIEM for the three accounting servers to confirm the SMB attempts were truly blocked and not partially successful.
6. Escalate the incident to High with a note explaining the stale rule, and open a ticket that survives shift change.

Order matters: fix the reason this was invisible first, then the reason analysts are overloaded, then automation. Tuning the noise floor before restoring this rule would just rebuild the same blind spot.

1. Restore the correlation rule, scoped. Re-enable it with an explicit exclusion list for known-good macro-driven finance applications rather than leaving it off. The rule was disabled because of false positives on a specific payroll spreadsheet; that is an exception case, not a rule-level defect.
2. Make severity reflect asset and identity, not just technique. Weight the score by whether the host is domain-joined, whether the user holds local admin, and whether the asset handles financial or regulated data. FIN-WS-2231 would have scored High from step one.
3. Build a FortiSOAR playbook with a narrow trigger. Auto-isolate only when at least two independent sources corroborate execution plus egress or lateral movement. Do not auto-isolate on single-source Medium alerts, because with 1,150 alerts/day that generates business outages and analysts will disable the playbook within a month.
4. Run the change in monitor-only for two weeks, then measure. Target false-positive rate below 2% for the auto-action trigger; if it is higher, tighten the trigger instead of widening the exclusions.
5. Add a regression guard: a quarterly review of every disabled rule with an owner and an expiry date, so 'temporarily off' cannot become permanent.

Risk to flag: over-tuning is the dominant failure mode in a two-analyst SOC. Every exclusion should be time-boxed and reviewed, never open-ended.

The CISO needs evidence that the SOC converts telemetry into contained incidents at a rate the business can absorb - not a wall of volume charts.

Measure:

• Median time from first precursor event to containment, split by severity. For this incident the honest number is roughly four minutes of precursor activity versus however long until the analyst acted; that gap is the metric that matters.
• Percentage of High incidents contained within the SOC's own SLA, with the reasons for misses categorised (staffing, tooling, disabled rule, approval delay).
• Analyst touches per incident. If a Medium chain takes nine manual steps, automation has a business case; if it takes two, it does not.
• Auto-action precision, i.e. confirmed true positives over total auto-isolations, plus business disruption minutes caused by automation. Both together, never precision alone.
• Detection coverage against the technique families relevant to this sector, reviewed as a coverage map rather than a raw rule count.

Deliberately not measure: total alerts, total rules, or EPS as success indicators. They reward noise generation. Also avoid mean time to close without segmenting by severity, because a flood of auto-closed low alerts will make the average look excellent while a genuine intrusion sits untouched.

Frame the recommendation as one sentence: two additional analyst-hours per shift or one automation engineer is cheaper than a quarter-end ransomware event, and here is the arithmetic behind that claim.