Incident Triage and Investigation
This domain tests moving from an alert to a defensible disposition. You need to know which investigation surfaces to use, how to scope an incident, and when to contain versus continue monitoring.
Core triage rules
- An alert is a detection event; an incident is the managed case. Severity, risk, status, assignment, and category are separate fields, so do not treat them as interchangeable.
- Investigate using the causality chain, timeline, story view, entity pages, and XQL searches across process, network, file, and identity data.
- Enrich with threat intelligence, file verdicts, hash and domain reputation, and user or asset context.
- Scope before closing: identify affected hosts, accounts, parent-child process relationships, persistence, and lateral movement.
- Record a disposition such as true positive, false positive, or benign, with the evidence that supports it.
Worked example
A “suspicious PowerShell” alert fires on an endpoint. Open the causality chain and inspect the command line, parent process, signing status, and user context. Check network connections and file verdicts. If the parent is an Office application and the command downloads an unsigned payload, treat it as malicious, scope other hosts with the same pattern, and contain the endpoint. If it is a signed administrative script run by a known admin, document the exception and close as benign. The reasoning is evidence-based: one indicator is not a disposition.
Traps that cost marks
- Closing on a single IOC without checking process ancestry and user context.
- Ignoring correlated low-severity alerts that form one campaign.
- Confusing alert status with incident status.
- Containing before scoping and losing evidence.
- Auto-closing high-severity incidents without human review.