Repeated C2 Alarms Closed Without a Case
At 09:12, an alarm fires for a workstation beaconing to a known command-and-control domain. Over the next two hours, three more alarms fire for the same host with different destination domains. Each alarm is acknowledged and closed as a false positive by a different analyst; no case is opened and the host is not isolated. At 13:40, the host begins encrypting file shares. The post-incident review finds that all relevant logs were collected and searchable, but the alarms were never linked, the host's risk was never accumulated, and no one had authority to isolate it without a case. You are redesigning the triage workflow. Constraints: no EDR, manual containment through network and Active Directory, and analysts are measured on alarm closure rate.
1. What alarm-handling, case, and escalation controls would you add so repeated alarms for one host cannot be closed independently?
Read the worked answer
The core failure is that each alarm was treated as an isolated event and closure rate rewarded speed over disposition quality. I would consolidate alarms by host and threat category, so the second through fourth C2 alarms attach to the same investigative thread rather than appearing as new work. I would auto-create a case for any confirmed C2 category alarm, or require an analyst to link an existing case before closing. Closure would require a disposition reason and would not be allowed with an open case unless a senior reviewer approves. I would add escalation on repeat: any host with a second high-severity alarm within 24 hours goes to the on-call lead and triggers a containment decision. I would change the analyst metric from alarms closed to quality-reviewed dispositions, and I would define who can authorize network or Active Directory containment without waiting for a fully populated case.
2. What evidence and timeline would you preserve, and how would LogRhythm support the review without compromising chain of custody?
Read the worked answer
I would preserve the original raw log records, alarm history, acknowledgement and closure actions with analyst identity, case notes, search queries used, and any exports. The timeline should start with the first C2 alarm and include each subsequent alarm, acknowledgement, closure reason, and the encryption onset. In LogRhythm I would search by the host identifier across the relevant log sources and time range, export the result set with timestamps and source fields, and attach it to the case rather than relying on a screenshot. I would record who exported what and when, and store the export in a controlled location with a hash if the review may become legal evidence. I would not alter original records or retention during the investigation; any normalization correction should be documented and applied to a copy, so the review can distinguish what the analyst saw at 09:12 from later reconstructed data.