Security Operations
The Security Operations domain tests the detection-and-response loop: how alerts are triaged, how incidents are run, how evidence is kept usable, and how detection content is tuned rather than abandoned.
Core rules
- Triage on impact and confidence together, weighted by asset criticality. A high-severity signature firing on a lab virtual machine is not a P1; a medium signature on a domain controller showing lateral movement may be.
- The incident response lifecycle runs preparation; detection and analysis; containment, eradication, and recovery; post-incident activity. Containment must be proportional - isolating a production cluster is a business decision as much as a technical one.
- Capture volatile evidence first: memory, live connections, running processes. Rebooting or reimaging destroys it.
- Map detections to MITRE ATT&CK so coverage gaps become visible. Hunt for techniques rather than static indicators; a technique costs an adversary far more to change than a hash or an IP address.
- Tune false positives by narrowing logic - a parent-process condition, an asset exclusion, a threshold - never by disabling the rule. Record the change so the next analyst understands it.
- Automation suits enrichment and reversible containment. Destructive actions stay behind a human.
Worked example
An alert shows WINWORD.EXE spawning powershell.exe with -enc and a long base64 argument. Reasoning: an Office process launching an encoded PowerShell child matches a known execution pattern. Decode the blob in a sandbox rather than on the host, check whether that parent-child pair is rare in the estate, and pivot on any domain in the decoded command. If it resolves to newly registered infrastructure with no business justification, isolate the host, capture memory, then hunt the same parent-child pair across all endpoints.
Traps that cost marks
Confusing severity with confidence. Closing an alert as benign without recording the reason. Rebooting before capturing memory. Treating one indicator match as proof of compromise, and treating a missed alert as proof that no activity occurred.