SOC Alert Triage & Investigation Workflow | Complete Guide

At 3:47 AM, your SIEM fires 127 alerts. Seventeen are critical. Your security operations center has 45 minutes before the business day starts in EMEA. Which alerts demand immediate action? Which are false positives? Which signal the early stages of a coordinated attack?

This is the daily reality of SOC alert triage—where speed, accuracy, and structured methodology separate effective security operations from chaos.

The Alert Overload Crisis

Nearly 90% of SOCs report being overwhelmed by alert backlogs and false positives. Security teams spend an average 30 minutes investigating each false positive alert, consuming 80% of analyst workload. Without structured triage processes, the industry average Mean Time to Conclusion (MTTC) stretches to 241 days from initial detection through final resolution.

But it doesn't have to be this way. By 2025, 50% of SOCs are expected to use AI-powered triage to validate alerts before human analysis, and organizations implementing structured workflows are seeing 90% reductions in investigation time.

Why Structured Alert Triage Matters

Reduce Alert Fatigue: Structured triage processes help analysts focus on genuine threats, not noise. When 60% of alerts turn out to be false positives, having a systematic approach to quickly identify and dismiss these saves countless hours.

Accelerate Detection: Proper triage reduces Mean Time to Detection (MTTD) by identifying true positives faster. The difference between detecting an attack in 5 minutes versus 5 hours can mean the difference between a contained incident and a company-wide breach.

Prevent Breaches: 70% of successful breaches began with alerts that were triaged incorrectly or ignored. Every misclassified critical alert is a potential disaster waiting to happen.

Optimize Resources: SOC teams reclaim up to 80% of workload capacity through automation and structured workflows, allowing analysts to focus on high-value threat hunting and investigation work.

Meet Compliance Requirements: NIST, ISO 27001, and SOC 2 mandate documented incident detection and response procedures. A structured triage workflow provides the documentation auditors require.

Framework Alignment

This workflow synthesizes best practices from three authoritative frameworks:

NIST SP 800-61r2: Computer Security Incident Handling Guide provides the four-phase lifecycle (Preparation, Detection & Analysis, Containment/Eradication/Recovery, Post-Incident Activity) that forms the backbone of incident response.

SANS Incident Response: Six-step process with emphasis on triage and prioritization (Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned) that ensures no step is missed during high-pressure incidents.

MITRE ATT&CK Framework: Tactics, techniques, and procedures (TTPs) for threat classification and investigation that allow us to speak a common language with the security community and predict attacker next moves.

The 6-Stage SOC Alert Triage Workflow

This workflow breaks down the complete alert lifecycle into six manageable stages:

1. Alert Reception & Initial Classification (1-5 minutes per alert)
2. Context Enrichment & Threat Intelligence (5-15 minutes)
3. Impact Assessment & Scope Determination (10-30 minutes)
4. Investigation & Evidence Collection (30 minutes - 4 hours)
5. Containment Recommendations & Escalation (15-60 minutes)
6. Documentation & Knowledge Base Updates (15-30 minutes)

Let's dive into each stage.

Stage 1: Alert Reception & Initial Classification (1-5 minutes)

The first few minutes after an alert fires are critical. This stage is about rapid triage: acknowledging the alert, performing initial classification, and routing it to the appropriate analyst tier or automation workflow.

Understanding Alert Sources

Modern SOC environments receive alerts from dozens of sources:

Endpoint Detection & Response (EDR): Suspicious process execution, privilege escalation, lateral movement attempts, and malware detections from your endpoint protection platform.

Network IDS/IPS: Port scans, DDoS patterns, exploit attempts, and command-and-control (C2) communications detected at the network level.

Email Security Gateway: Phishing attempts, malicious attachments, spoofing attempts, and business email compromise (BEC) indicators.

Cloud Security Posture (CSPM): Misconfigurations, IAM violations, unusual API activity, and compliance drift in your cloud infrastructure.

Database Activity Monitoring (DAM): Unauthorized queries, data exfiltration attempts, and privilege abuse on critical databases.

Web Application Firewall (WAF): SQL injection, cross-site scripting (XSS), authentication bypasses, and other OWASP Top 10 attacks.

Data Loss Prevention (DLP): Sensitive data transfers, policy violations, and potential data exfiltration.

Threat Intelligence Feeds: IOC matches for malicious IPs, domains, file hashes, and other indicators of compromise.

MITRE ATT&CK-Aligned Alert Categories

Every alert maps to one or more MITRE ATT&CK tactics. Understanding this mapping during initial triage helps you predict attacker objectives and next moves:

Alert Intake & Deduplication

Your first task is understanding what you're looking at:

Initial Alert Review (30-60 seconds):

• Review alert timestamp and source system
• Check if alert is duplicate of existing investigation
• Identify alert signature/rule name and confidence score
• Note affected asset (hostname, IP, user account)

Deduplication Strategy: When you see 45 alerts for "Failed Login Attempt" from the same IP address, don't investigate 45 times. Deduplicate to a single investigation: "Brute Force Attack - 192.0.2.15" and aggregate the data: 45 attempts across 12 user accounts over 15 minutes.

Most SIEM platforms support native deduplication rules that correlate by source IP, destination, and timeframe. Use these features aggressively to reduce alert noise.

Severity Classification Framework

Not all alerts are created equal. Use this SANS-inspired classification framework:

CRITICAL (P1) - Immediate Response Required:

• Active data exfiltration in progress
• Ransomware/destructive malware detected
• Confirmed privilege escalation on critical system
• C2 callback from production server
• Mass credential compromise

HIGH (P2) - Respond Within 30 Minutes:

• Suspicious lateral movement detected
• Malware detected but contained by EDR
• Reconnaissance activity on sensitive systems
• Failed privileged access attempts (multiple)
• Known vulnerability exploitation attempt

MEDIUM (P3) - Respond Within 2 Hours:

• Policy violations (non-critical systems)
• Low-confidence threat indicators
• Reconnaissance on non-critical systems
• Single failed authentication with no pattern
• Suspicious but benign user behavior

LOW (P4) - Queue for Review:

• Informational alerts
• Known false positives pending tuning
• Compliance logging events
• Network noise on isolated segments

Priority Modifiers: Adjust severity based on context:

• +1 Severity: Critical business system (financial, healthcare, executive)
• +1 Severity: Involves PII, PHI, payment card data, or trade secrets
• +1 Severity: Multiple tactics observed (indicates advanced attacker)
• -1 Severity: Test/development environment
• -1 Severity: Known false positive pattern with existing tuning ticket

Rapid Triage Checklist

Answer these questions in 60 seconds or less:

• Is this alert actionable? (Can we investigate further?)
• Is the affected asset business-critical? (Production vs. dev/test?)
• Does alert match known false positive pattern? (Check FP database)
• Is sensitive data potentially at risk? (PII, PHI, financial, IP)
• Is attack still in progress? (Active threat vs. historical detection)
• Are multiple alerts correlated? (Part of larger attack chain)

Decision Tree:

Alert Received
  ↓
Known False Positive? → YES → Close with "False Positive - Known Pattern" → Update FP ruleset
  ↓ NO
Sufficient Info to Investigate? → NO → Request additional logs/context → Assign to L2
  ↓ YES
Critical/High Severity? → YES → Immediate escalation to L2/L3 + potential IR activation
  ↓ NO
Assign to Queue → Standard investigation workflow

Initial Tools & Data Collection

InventiveHQ Tools for Initial Classification:

1. IOC Extractor (/tools/ioc-extractor)

   • Extract IPs, domains, hashes, URLs from raw alert data
   • Standardize IOC formats for threat intel lookup
   • Generate preliminary indicator list for investigation

2. IP Risk Checker (/tools/ip-risk-checker)

   • Quick reputation check on source/destination IPs
   • Identify geographic anomalies (access from unusual country)
   • Check if IP is known malicious infrastructure

3. MITRE ATT&CK Browser (/tools/mitre-attack)

   • Map alert to MITRE ATT&CK technique ID
   • Understand attacker objectives for this tactic
   • Identify common follow-on techniques

Stage 1 Deliverables

At the end of Stage 1, you should have:

• Alert classified with severity (P1-P4) and category (MITRE tactic)
• Initial IOC list extracted
• Alert assigned to analyst or automation workflow
• Case/ticket created in incident management system
• Initial timeline entry: "Alert detected at [timestamp]"

Example Classification Output:

Alert ID: SIEM-2025-12-08-8472
Title: Suspicious PowerShell Execution - WORKSTATION-042
Severity: HIGH (P2)
Category: Execution (TA0002) / Defense Evasion (TA0005)
Assigned To: SOC-L2-Analyst-3
Status: Under Investigation
Initial IOCs:
  - Hostname: WORKSTATION-042.corp.local
  - User: [email protected]
  - Process: powershell.exe -encodedCommand [base64]
  - Parent Process: WINWORD.EXE
  - Timestamp: 2025-12-08 08:47:23 UTC

Stage 2: Context Enrichment & Threat Intelligence (5-15 minutes)

Raw alerts tell you what happened. Context tells you why it matters. This stage is about enriching alerts with asset context, correlating with threat intelligence, and gathering additional logs for analysis.

Asset Context Enrichment

Critical Context to Gather:

Asset Information:

• Asset Criticality: Business-critical? Customer-facing? Contains sensitive data?
• Asset Owner: Business unit, IT contact, executive sponsor
• Asset Location: Data center, cloud provider (AWS/Azure/GCP), office location
• Asset Type: Server, workstation, network device, cloud resource
• Operating System: Windows Server 2022, Ubuntu 22.04, macOS, etc.
• Installed Applications: Databases, web servers, business applications
• Patch Status: Last patched date, known vulnerabilities
• Network Segment: DMZ, internal network, PCI zone, production vs. dev

User Context (If User Account Involved):

• User Role: Standard user, administrator, service account, privileged user
• Department: Finance, HR, Engineering, Executive
• Manager: Reporting structure for escalation
• Typical Behavior: Normal work hours, typical geolocation, device usage
• Previous Incidents: Any prior security alerts for this user?
• Recent Changes: New hire? Role change? Departing employee?

Tools for Enrichment:

1. WHOIS Lookup (/tools/whois-lookup)

   • Investigate domain ownership for suspicious domains
   • Identify registration dates (recently registered = higher risk)
   • Check nameservers and hosting provider

2. DNS Lookup (/tools/dns-lookup)

   • Resolve suspicious domains to IP addresses
   • Check MX records for email-based threats
   • Identify DNS anomalies (fast flux, DGA patterns)

3. IP Geolocation Lookup (/tools/ip-geolocation-lookup)

   • Determine geographic origin of suspicious IPs
   • Identify impossible travel scenarios (user in US, login from Russia)
   • Correlate with business context (expected vs. anomalous locations)

Threat Intelligence Correlation

Threat Intel Sources to Query:

Commercial Feeds: CrowdStrike Threat Intelligence, Recorded Future, ThreatConnect, Anomali ThreatStream, MISP (Malware Information Sharing Platform)

Open-Source Intelligence (OSINT): VirusTotal (file hash, IP, domain reputation), AbuseIPDB (IP abuse reports), AlienVault OTX (Open Threat Exchange), URLhaus (malware distribution URLs), Shodan (internet-facing asset intelligence)

Internal Threat Intel: Previous incident IOCs from your organization, watchlist of known threat actors targeting your industry, industry-specific ISACs (FS-ISAC, H-ISAC, etc.)

Threat Intelligence Lookup Workflow:

1. Extract all IOCs from alert (IPs, domains, URLs, file hashes, email addresses)
2. Query threat intel feeds for each IOC
3. Document matches:
   • IOC: 198.51.100.45
   • Intel Source: CrowdStrike
   • Classification: C2 Infrastructure for Emotet botnet
   • First Seen: 2025-12-05
   • Confidence: High
4. Correlate with MITRE ATT&CK: If malware family identified, map to ATT&CK techniques

InventiveHQ Tools for Threat Intel:

1. Threat Intelligence Feed Aggregator (/tools/threat-intel-aggregator)

   • Aggregate IOCs from multiple threat feeds
   • Deduplicate indicators across sources
   • Export consolidated IOC collections

2. Hash Lookup (/tools/hash-lookup)

   • Query file hashes against malware databases
   • Identify known malicious files
   • Determine malware family and capabilities

3. URL Defanger (/tools/url-defanger)

   • Defang malicious URLs for safe documentation
   • Share indicators without accidental clicks
   • Refang for automated analysis tools

4. Certificate Transparency Lookup (/tools/certificate-transparency-lookup)

   • Investigate SSL certificates for phishing domains
   • Identify certificate abuse (typosquatting, brand impersonation)
   • Discover attacker infrastructure

Log Correlation & Timeline Building

Additional Log Sources to Query:

Endpoint Logs (EDR/Sysmon/Windows Event Logs):

• Process execution history (parent-child relationships)
• Network connections initiated by suspicious process
• File system modifications (new files created, deleted)
• Registry changes
• Authentication events (logon/logoff)

Network Logs:

• Firewall logs (allowed/denied connections)
• Proxy logs (web requests, downloads)
• DNS queries (what domains did endpoint resolve?)
• VPN logs (remote access sessions)
• Network flow data (NetFlow/IPFIX)

Email Logs (If Phishing Suspected):

• Email headers and routing
• Attachment hashes
• Link analysis
• Sender authentication (SPF/DKIM/DMARC results)

Cloud Logs (AWS/Azure/GCP):

• CloudTrail (API activity)
• Azure Activity Logs
• GCP Audit Logs
• IAM events (role assumptions, permission changes)

Timeline Building Example:

2025-12-08 08:42:15 UTC - User [email protected] receives email from [email protected]
2025-12-08 08:43:02 UTC - User opens attachment "Invoice_Q4.docx" (SHA256: abc123...)
2025-12-08 08:43:45 UTC - WINWORD.EXE spawns powershell.exe with encoded command
2025-12-08 08:44:03 UTC - PowerShell downloads payload from hxxp://198.51.100[.]45/stage2.exe
2025-12-08 08:44:28 UTC - stage2.exe executed (Emotet malware, per VirusTotal)
2025-12-08 08:45:12 UTC - Outbound C2 connection to 198.51.100[.]45:443
2025-12-08 08:47:23 UTC - SIEM alert triggered: "Suspicious PowerShell Execution"

InventiveHQ Tools for Log Analysis:

1. Email Header Analyzer (/tools/email-header-analyzer)

   • Analyze phishing email headers
   • Trace email routing and origin
   • Validate SPF/DKIM/DMARC authentication

2. Base64 Encoder/Decoder (/tools/base64-encoder-decoder)

   • Decode obfuscated PowerShell commands
   • Analyze encoded payloads
   • Extract hidden IOCs from base64 strings

3. Malware Deobfuscator (/tools/malware-deobfuscator)

   • Deobfuscate malicious scripts (JavaScript, PowerShell, VBS)
   • Apply multi-technique deobfuscation with auto-detection
   • Chain deobfuscation methods for heavily obfuscated malware

Stage 2 Deliverables

At the end of Stage 2, you should have:

• Enriched alert with asset/user context
• Threat intelligence findings documented
• Preliminary attack timeline
• Correlation with related alerts or historical incidents
• Updated investigation notes in case management system

Stage 3: Impact Assessment & Scope Determination (10-30 minutes)

Now that you understand what happened and the context, it's time to determine the blast radius and business impact. This stage answers critical questions: How many systems are affected? Has lateral movement occurred? Do we need to escalate to the incident response team?

Blast Radius Analysis

Key Questions:

1. How many systems are affected? Single workstation? Multiple servers? Entire network segment? Query your SIEM for similar alerts across other assets.

2. Has lateral movement occurred? Look for network connections from compromised host to other internal systems. Check for remote desktop, SMB, WinRM, SSH sessions. Review authentication logs for unusual account usage.

3. Are service accounts compromised? Service account compromise means potential widespread access. Check for privilege escalation indicators and review recent permission changes.

4. Is attacker still active? Active C2 connections? Ongoing data exfiltration? Real-time reconnaissance or exploitation?

Scoping Workflow:

Initial Alert: WORKSTATION-042 compromised
  ↓
Query SIEM: Any alerts on other workstations from same IP 198.51.100[.]45?
  → Found: WORKSTATION-087, SERVER-DB-01 also contacted same IP
  ↓
Query Network Logs: Did WORKSTATION-042 initiate lateral connections?
  → Found: SMB connections to FILE-SERVER-03
  ↓
Query EDR: Any malicious activity on FILE-SERVER-03?
  → Found: Suspicious scheduled task created
  ↓
SCOPE DETERMINATION: 4 systems affected (3 workstations, 1 file server)

InventiveHQ Tools for Scope Analysis:

1. Subnet Calculator (/tools/subnet-calculator)

   • Determine network ranges affected
   • Calculate if entire subnet is at risk
   • Identify network segmentation boundaries

2. Port Reference (/tools/port-reference)

   • Identify services running on affected systems
   • Understand attack surface for lateral movement
   • Reference 5,900+ port database for unusual services

Business Impact Assessment

Impact Categories:

Operational Impact:

• Service Disruption: Are critical business services down or degraded?
• Productivity Loss: How many users unable to work?
• System Availability: Revenue-generating systems affected?
• Data Accessibility: Can business access critical data?

Financial Impact:

• Revenue Loss: Direct loss from system downtime
• Recovery Costs: Incident response, forensics, system rebuild
• Regulatory Fines: GDPR, HIPAA, PCI-DSS penalties if data breach
• Customer Compensation: SLA credits, refunds, settlements

Reputational Impact:

• Customer Trust: Will customers lose confidence?
• Media Attention: Likely press coverage?
• Competitive Disadvantage: Will competitors gain advantage?
• Brand Damage: Long-term reputation harm?

Compliance Impact:

• Data Breach Notification: Required under GDPR/state laws?
• Regulatory Reporting: Must notify HHS, regulators, law enforcement?
• Audit Findings: Will incident result in compliance audit failures?
• Certification Risk: SOC 2, ISO 27001 certification at risk?

Impact Matrix:

Escalation Decision Matrix

When to Escalate to Incident Response (IR) Team:

IMMEDIATE IR ACTIVATION (Critical Incidents):

• Active ransomware/destructive malware
• Confirmed data exfiltration of PII/PHI/PCI
• Compromise of critical infrastructure (domain controller, backup servers)
• C-level executive account compromise
• Media inquiries about potential breach
• Law enforcement notification received
• Suspected nation-state actor (APT group)

ESCALATE TO L3/IR WITHIN 30 MINUTES (High-Priority):

• Privilege escalation on production systems
• Lateral movement across multiple network segments
• Service account compromise
• Malware outbreak affecting >10 systems
• Suspected insider threat
• Failed containment attempts

STANDARD L2 INVESTIGATION (Medium-Priority):

• Single system compromise, no lateral movement
• Malware contained by EDR
• Failed exploitation attempt (no success)
• Policy violations requiring investigation
• Anomalous user behavior (not clearly malicious)

L1 RESOLUTION (Low-Priority):

• Confirmed false positives
• Blocked attacks (no compromise)
• Informational alerts
• Compliance logging events

Escalation Communication Template:

TO: [email protected]
CC: [email protected]
SUBJECT: [CRITICAL] Incident Escalation - Emotet Malware Outbreak

INCIDENT SUMMARY:
- Alert ID: SIEM-2025-12-08-8472
- Severity: CRITICAL (P1)
- Systems Affected: 4 (3 workstations, 1 file server)
- Attack Type: Emotet malware via phishing
- Status: Attacker active, C2 communications ongoing
- Business Impact: File server contains customer PII

ACTIONS TAKEN:
- Isolated WORKSTATION-042 from network
- Disabled user account [email protected]
- EDR containment initiated on all 4 systems

IMMEDIATE NEEDS:
- Network segmentation to prevent further lateral movement
- Forensic image of FILE-SERVER-03
- Legal consultation for potential data breach notification

IR ACTIVATION REQUESTED: YES

Stage 3 Deliverables

At the end of Stage 3, you should have:

• Scope determination (number of systems, users, data repositories affected)
• Business impact assessment (operational, financial, reputational)
• Escalation decision and IR activation (if required)
• Stakeholder notification (IT management, business units, executives)
• Updated case priority and status

Stage 4: Investigation & Evidence Collection (30 minutes - 4 hours)

This is where deep technical analysis happens. The goal is to determine root cause, map the attack to MITRE ATT&CK, identify all compromised systems and data, and collect forensic evidence for potential legal or compliance needs.

Detailed Technical Analysis

Investigation Workflow by Attack Type:

Malware Investigation:

1. File Analysis:

   • Obtain file hashes (MD5, SHA1, SHA256)
   • Submit to VirusTotal, hybrid-analysis.com
   • Analyze file metadata (creation time, compiler, packer)
   • Identify malware family and capabilities

2. Behavioral Analysis:

   • Review process execution tree
   • Identify persistence mechanisms (registry, scheduled tasks, services)
   • Map network indicators (C2 IPs, domains, User-Agent strings)
   • Document files created, modified, deleted

3. Memory Forensics (If Advanced Analysis Required):

   • Capture memory dump from infected system
   • Extract injected code, credentials, encryption keys
   • Identify rootkit or anti-forensics techniques

Phishing Investigation:

1. Email Analysis:

   • Full header analysis (received headers, authentication results)
   • Sender validation (SPF/DKIM/DMARC checks)
   • Attachment analysis (file type, macros, embedded objects)
   • Link analysis (redirect chains, final destination)

2. Scope Determination:

   • How many users received same email? (Query email gateway logs)
   • How many users clicked link or opened attachment?
   • Were credentials harvested? (Check authentication logs for unusual logins)

3. Infrastructure Mapping:

   • Identify phishing kit infrastructure
   • Map all related domains and IPs
   • Determine if part of larger campaign

Account Compromise Investigation:

1. Authentication Review:

   • All login attempts for compromised account (success + failures)
   • Source IPs and geolocation
   • User-Agent strings (device/browser identification)
   • Authentication method (password, MFA, SSO)

2. Post-Compromise Activity:

   • Email rules created (forwarding, auto-delete)
   • Data accessed (emails, files, databases)
   • Privilege escalation attempts
   • Account modifications (password resets, MFA changes)

InventiveHQ Tools for Investigation:

1. Hash Generator (/tools/hash-generator)

   • Generate cryptographic hashes for suspicious files
   • Integrate with VirusTotal for malware checking
   • Document file integrity for evidence chain

2. String Extractor (/tools/string-extractor)

   • Extract ASCII/Unicode strings from malware binaries
   • Identify hardcoded IPs, domains, file paths
   • Detect IOC patterns in executables

3. Entropy Analyzer (/tools/entropy-analyzer)

   • Calculate Shannon entropy to detect packed/encrypted malware
   • Identify obfuscated sections of binaries
   • Flag potential malware samples

4. Hex Editor (/tools/hex-editor)

   • Binary file analysis and inspection
   • Search for specific byte patterns
   • Bookmark suspicious file regions

5. Machine Code Disassembler (/tools/machine-code-disassembler)

   • Disassemble x86/ARM/RISC-V machine code
   • Analyze shellcode and exploits
   • Generate call graphs and performance analysis

MITRE ATT&CK Mapping

Why Map to ATT&CK:

• Understand attacker's objectives and progression through kill chain
• Predict next likely attack stages
• Communicate attack in standardized framework
• Improve detection rules based on observed TTPs
• Share threat intelligence with industry peers

Mapping Workflow:

1. Identify Initial Access Technique: Example: T1566.001 - Phishing: Spearphishing Attachment

2. Document Execution Techniques: Example: T1059.001 - Command and Scripting Interpreter: PowerShell

3. Note Persistence Mechanisms: Example: T1053.005 - Scheduled Task/Job: Scheduled Task

4. Capture Privilege Escalation: Example: T1055 - Process Injection

5. Identify Defense Evasion: Example: T1027 - Obfuscated Files or Information

6. Document Credential Access: Example: T1003.001 - OS Credential Dumping: LSASS Memory

7. Map Lateral Movement: Example: T1021.002 - Remote Services: SMB/Windows Admin Shares

8. Note Collection Activities: Example: T1005 - Data from Local System

9. Identify Exfiltration (If Occurred): Example: T1041 - Exfiltration Over C2 Channel

Use the MITRE ATT&CK Browser (/tools/mitre-attack) to browse tactics and techniques, map observed behavior to technique IDs, and identify common follow-on techniques.

ATT&CK Mapping Output Example:

MITRE ATT&CK Analysis - Emotet Infection

Initial Access:
  T1566.001 - Phishing: Spearphishing Attachment

Execution:
  T1204.002 - User Execution: Malicious File
  T1059.001 - Command and Scripting Interpreter: PowerShell

Persistence:
  T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys
  T1053.005 - Scheduled Task/Job: Scheduled Task

Defense Evasion:
  T1027 - Obfuscated Files or Information
  T1140 - Deobfuscate/Decode Files or Information

Command and Control:
  T1071.001 - Application Layer Protocol: Web Protocols (HTTPS)
  T1573.002 - Encrypted Channel: Asymmetric Cryptography

Impact:
  (None observed - likely precursor to ransomware deployment)

Evidence Collection & Chain of Custody

Critical Evidence to Preserve:

System Forensics:

• Memory dumps (volatile data before shutdown)
• Disk images (full forensic copy)
• System logs (Windows Event Logs, Syslog, application logs)
• Network packet captures (PCAP files)
• EDR telemetry and alerts

File Evidence:

• Malware samples (in password-protected archives)
• Suspicious documents (phishing attachments)
• Modified system files
• Log files showing attacker activity

Network Evidence:

• Firewall logs showing C2 communications
• Proxy logs with full HTTP requests/responses
• DNS query logs
• NetFlow/IPFIX records

Email Evidence:

• Raw email (.eml) files with full headers
• Attachments
• Email gateway logs

Chain of Custody Documentation:

Evidence Item: Memory Dump - WORKSTATION-042
Collected By: John Smith, SOC L2 Analyst
Collection Date/Time: 2025-12-08 09:15:32 UTC
Collection Method: winpmem memory acquisition tool
File Hash (SHA256): e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Storage Location: \\forensics-nas\case-2025-001\evidence\
Access Log: [List of all personnel who accessed evidence]

Legal Considerations:

• Preserve attorney-client privilege (conduct investigation under legal counsel direction)
• Document chain of custody for potential litigation
• Do NOT destroy evidence prematurely
• Engage digital forensics experts for high-stakes investigations

Stage 4 Deliverables

At the end of Stage 4, you should have:

• Comprehensive technical analysis report
• MITRE ATT&CK mapping of observed TTPs
• Evidence collection with chain of custody documentation
• Root cause determination
• List of all compromised systems, accounts, and data
• Forensic timeline of attacker activity

Stage 5: Containment Recommendations & Escalation (15-60 minutes)

Now that you understand the attack, it's time to stop it. This stage is about recommending immediate containment actions, coordinating with IT operations and business stakeholders, implementing eradication steps, and preparing for recovery.

Containment Strategy

Containment Levels (Balanced Against Business Continuity):

Level 1: Monitoring Only (Low-Risk Alerts)

• Alert is informational or failed attack attempt
• No containment needed
• Continue monitoring for escalation

Level 2: Soft Containment (Medium-Risk)

• Disable compromised user account
• Block malicious IPs/domains at firewall/proxy
• Reset passwords for affected accounts
• Increase monitoring on affected systems
• Business operations continue with minimal impact

Level 3: Aggressive Containment (High-Risk)

• Isolate affected systems from network (EDR network containment)
• Disable compromised service accounts
• Block entire C2 infrastructure at perimeter
• Shut down affected services if necessary
• Coordinate with business for service disruption

Level 4: Network Segmentation (Critical Incidents)

• Isolate entire network segments (VLANs, subnets)
• Disable inter-segment routing
• Implement emergency firewall rules
• Potential full network shutdown if ransomware spreading
• Executive approval required for business-wide impact

Containment Decision Matrix:

Containment Actions by Attack Type

Malware Containment:

1. EDR Network Containment: Isolate infected endpoints
2. Block C2 Infrastructure: Add all C2 IPs/domains to firewall/DNS blocklist
3. Kill Malicious Processes: Terminate via EDR or force system shutdown
4. Disable Persistence: Remove scheduled tasks, registry keys, services
5. Network Isolation: VLAN isolation if malware spreading laterally

Account Compromise Containment:

1. Disable Account: Immediately revoke access
2. Terminate Active Sessions: Force logout across all systems
3. Reset Credentials: Password reset + force MFA re-enrollment
4. Revoke Tokens/Sessions: OAuth tokens, API keys, SSO sessions
5. Block Attacker IPs: Prevent re-access from known attacker infrastructure

Phishing Campaign Containment:

1. Email Purge: Delete phishing emails from all mailboxes
2. Block Sender: Add sender domain/IP to email gateway blocklist
3. URL Blocking: Block phishing URLs at proxy/firewall/DNS
4. User Notification: Alert affected users, remind security awareness
5. Monitor for Clicks: Check web proxy logs for users who clicked

Data Exfiltration Containment:

1. Network Isolation: Immediately cut external connectivity for affected systems
2. DLP Policy Enforcement: Activate stricter DLP rules
3. Cloud Access Restriction: Suspend cloud API access for compromised accounts
4. Forensic Preservation: Capture evidence before eradication
5. Legal Notification: Alert legal team for potential breach notification requirements

Coordination with Stakeholders:

Containment Notification Template:

TO: [email protected]
CC: [email protected], [email protected]
SUBJECT: [URGENT] Containment Action Required - WORKSTATION-042

SITUATION:
Emotet malware detected on WORKSTATION-042 with active C2 connection.
Malware has spread to FILE-SERVER-03.

IMMEDIATE ACTION REQUIRED:
1. Network isolation of WORKSTATION-042 and FILE-SERVER-03
2. Disable network ports: SW-FLOOR3-PORT-12, SW-DC-PORT-45
3. Disable user account: [email protected]

BUSINESS IMPACT:
- User jdoe will be unable to work until remediation complete (~4 hours)
- FILE-SERVER-03 offline during forensic imaging (estimated 2-3 hours)
- 15 users dependent on FILE-SERVER-03 will use backup file access

APPROVED BY: [SOC Manager Name]
TIMELINE: Immediate execution required

Eradication Planning

Eradication Actions (Remove Attacker Presence):

Malware Eradication:

• Reimage affected systems (preferred) OR antivirus removal (if low-risk)
• Remove all persistence mechanisms
• Validate no malware remnants remain (EDR scan, memory analysis)

Account Compromise Eradication:

• Force password reset for all potentially compromised accounts
• Audit and remove unauthorized:
  • Email forwarding rules
  • OAuth grants
  • API keys
  • Service principals (cloud)
  • SSH keys

Backdoor/Persistence Eradication:

• Remove attacker-created accounts
• Delete scheduled tasks, cron jobs
• Remove malicious registry keys
• Uninstall unauthorized software
• Reset local administrator passwords

Network Eradication:

• Update firewall rules to block attacker infrastructure permanently
• Revoke compromised VPN certificates
• Rotate network device credentials if accessed

Escalation & Stakeholder Communication

Who to Notify:

Technical Teams: IT Operations (system isolation, password resets), Network Engineering (firewall rules, network segmentation), Cloud Team (cloud resource containment), Application Owners (affected business applications)

Management: SOC Manager (immediate notification), IT Director/CIO (high/critical incidents), CISO (critical incidents, potential breaches), Business Unit Leaders (if services disrupted), CEO/Board (critical incidents with major business impact)

Compliance & Legal: Legal Counsel (potential data breaches, legal holds), Compliance Officer (regulatory notification requirements), Privacy Officer (PII/PHI exposure), HR (insider threat investigations)

External Parties (If Required): Law Enforcement (criminal activity, nation-state actors), Cyber Insurance Provider (major incidents), Forensic Investigators (complex incidents), Regulators (breach notification - GDPR, HHS, state AGs)

Escalation Communication Best Practices:

• Be concise: Executives want summary, not technical details
• Quantify impact: Number of systems, users, data records
• Provide options: Present containment options with trade-offs
• Set expectations: Timeline for resolution, next updates
• Avoid speculation: Only report confirmed facts
• Use visual aids: Network diagrams, attack timelines

Stage 5 Deliverables

At the end of Stage 5, you should have:

• Containment actions implemented and documented
• Eradication plan developed
• Stakeholder notifications sent
• Executive briefing prepared (1-2 slides)
• Escalation to IR team (if applicable)
• Updated incident status and timeline

Stage 6: Documentation & Knowledge Base Updates (15-30 minutes)

The incident may be contained, but the work isn't done. This final stage is about documenting the complete incident, updating detection rules, creating knowledge base articles, conducting post-incident reviews, and sharing threat intelligence with the community.

Incident Report Documentation

Comprehensive Incident Report Sections:

1. Executive Summary (1 paragraph)

• Incident type and severity
• Business impact quantified
• Containment status
• Next steps

2. Incident Timeline

2025-12-08 08:42:15 UTC - Phishing email received by user
2025-12-08 08:43:45 UTC - Malicious PowerShell execution
2025-12-08 08:47:23 UTC - SIEM alert triggered
2025-12-08 09:15:00 UTC - Investigation initiated by SOC L2
2025-12-08 09:45:00 UTC - Malware identified (Emotet)
2025-12-08 10:05:00 UTC - Containment actions implemented
2025-12-08 11:30:00 UTC - Systems isolated and eradication begun
2025-12-08 14:00:00 UTC - Incident contained, no further spread

3. Technical Analysis

• Attack vector and entry point
• Malware family and capabilities
• MITRE ATT&CK technique mapping
• Systems and accounts compromised
• Data accessed or exfiltrated (if any)

4. Indicators of Compromise (IOCs)

Malicious IPs:
  - 198.51.100.45 (C2 server)
  - 203.0.113.67 (payload distribution)

Malicious Domains:
  - invoice-portal[.]xyz
  - update-server[.]info

File Hashes (SHA256):
  - abc123def456... (Invoice_Q4.docx - phishing attachment)
  - 789ghi012jkl... (stage2.exe - Emotet payload)

Email Indicators:
  - From: [email protected]
  - Subject: "Urgent: Outstanding Invoice - Payment Required"

5. Containment & Eradication Actions

• Systems isolated
• Accounts disabled
• Passwords reset
• Firewall rules updated
• Systems reimaged

6. Business Impact

• Systems affected: 4 (3 workstations, 1 file server)
• Users impacted: 16
• Downtime: 4 hours (FILE-SERVER-03)
• Data exposure: None confirmed
• Estimated cost: $8,000 (IT labor, forensics, productivity loss)

7. Root Cause Analysis

• Successful phishing email bypassed email gateway
• User lacked security awareness training
• Endpoint lacked macro blocking policy
• SIEM alert delay (5 minutes after initial execution)

8. Recommendations

• Deploy email security awareness training (quarterly)
• Implement macro blocking via Group Policy
• Tune SIEM rules to reduce alert delay
• Add C2 domains to threat intel feed

Use the Incident Response Playbook Generator (/tools/incident-response-playbook-generator) to create customized IR playbooks for common scenarios with compliance guidance (GDPR, HIPAA, PCI-DSS) and export to PDF/Markdown.

Detection Rule Tuning

Improving Detection Based on Incident:

New Detection Rules to Create:

1. Emotet-Specific Detection: Alert on WINWORD.EXE spawning powershell.exe with base64-encoded commands
2. C2 Communication: Block and alert on connections to 198.51.100.45 and related infrastructure
3. Email Pattern: Flag emails with subject "Outstanding Invoice" from external domains
4. File Hash Blacklist: Block execution of known Emotet hashes

Existing Rules to Tune:

1. Reduce False Positives: If alert had prior false positives, add exceptions
2. Increase Sensitivity: If alert delay was too long, reduce threshold
3. Correlation Rules: Create multi-stage correlation (email + PowerShell + C2 = high confidence)

SIEM Rule Example (Splunk SPL):

index=endpoint sourcetype=sysmon EventCode=1
| search ParentImage="*WINWORD.EXE" Image="*powershell.exe" CommandLine="*-encodedCommand*"
| table _time host User ParentImage Image CommandLine
| eval severity="HIGH"
| eval mitre_technique="T1059.001"
| alert

Knowledge Base Updates

KB Article Template: "How to Respond to Emotet Malware"

## Overview
Emotet is a modular banking trojan that spreads via phishing emails and often leads to ransomware deployment.

## Detection Indicators
- WINWORD.EXE spawning PowerShell with encoded commands
- Outbound HTTPS connections to known C2 infrastructure
- Creation of scheduled tasks for persistence

## Immediate Response
1. Isolate affected system via EDR network containment
2. Disable compromised user account
3. Block C2 IP addresses at firewall
4. Escalate to SOC L2 for investigation

## Containment
- Isolate system (do not power off - preserve memory)
- Block C2 domains: [list]
- Reset user credentials
- Check for lateral movement

## Eradication
- Reimage infected systems (preferred)
- Remove scheduled tasks: [specific task names]
- Scan network for additional infections

## Recovery
- Restore from clean backup (if reimage not feasible)
- Validate EDR is operational
- Monitor for 48 hours post-recovery

## MITRE ATT&CK Mapping
- T1566.001 - Phishing: Spearphishing Attachment
- T1059.001 - Command and Scripting Interpreter: PowerShell
- T1053.005 - Scheduled Task/Job: Scheduled Task

## References
- [Internal Link to Full Incident Report]
- [MITRE ATT&CK: Emotet]
- [CISA Alert: Emotet]

KB Categories to Update:

• Malware Response Procedures
• Phishing Investigation Workflows
• MITRE ATT&CK Technique Library
• IOC Repository (centralized threat intel)

Post-Incident Review (PIR)

PIR Meeting Agenda (30-60 minutes):

1. Incident Review (10 minutes)

• What happened? (timeline recap)
• How was it detected?
• What was the impact?

2. What Went Well (10 minutes)

• Effective EDR containment prevented spread
• SOC L2 responded within 30 minutes
• Cross-team coordination (SOC + IT Ops) was efficient

3. What Went Poorly (15 minutes)

• SIEM alert delay (5 minutes after initial execution)
• User lacked security awareness training
• Email gateway failed to block phishing email
• No macro blocking policy on endpoints

4. Action Items (15 minutes)

5. Metrics & KPIs (10 minutes)

• MTTD (Mean Time to Detect): 5 minutes (from execution to SIEM alert)
• MTTI (Mean Time to Investigate): 28 minutes (alert to containment decision)
• MTTC (Mean Time to Contain): 1 hour 18 minutes (alert to full containment)
• MTTR (Mean Time to Recover): 4 hours 13 minutes (alert to systems restored)

PIR Deliverable:

• Meeting notes documented in incident case file
• Action items tracked in project management system
• Metrics added to SOC dashboard
• Lessons learned shared in team meeting

Threat Intelligence Sharing

When to Share IOCs Externally:

• Novel malware or TTPs observed
• Industry-specific targeting (share with ISAC)
• Threat actor infrastructure discovery
• Zero-day exploitation

Sharing Mechanisms: MISP (Malware Information Sharing Platform), ISACs (FS-ISAC, H-ISAC, etc.), STIX/TAXII (Structured threat intelligence exchange), AlienVault OTX (Open Threat Exchange), VirusTotal (Upload malware samples for community analysis)

What NOT to Share:

• Customer/company proprietary information
• Internal network architecture
• Specific vulnerabilities in your environment (until patched)
• Sensitive incident details (data breach scope, ransom payments)

Threat Intel Sharing Example:

Threat: Emotet Phishing Campaign - December 2025

IOCs:
  IPs: 198.51.100.45, 203.0.113.67
  Domains: invoice-portal[.]xyz, update-server[.]info
  File Hashes: [SHA256 list]

TTPs:
  - Spearphishing with invoice-themed lures
  - Macro-enabled Word documents
  - PowerShell with base64 encoding
  - HTTPS C2 communication
  - Scheduled task persistence

MITRE ATT&CK:
  T1566.001, T1059.001, T1053.005

Confidence: High
Targeting: Financial services sector
First Observed: 2025-12-08

Stage 6 Deliverables

At the end of Stage 6, you should have:

• Complete incident report documented in case management system
• Detection rules updated or created
• Knowledge base articles published
• Post-incident review conducted with action items
• Threat intelligence shared with community (if applicable)
• Incident metrics tracked (MTTD, MTTI, MTTC, MTTR)

Supporting Framework Integration

NIST SP 800-61r2 Alignment

This workflow maps directly to the NIST Incident Response lifecycle:

1. Preparation: SOC team training and readiness, detection rules and SIEM configuration, incident response playbooks documented, tools and access provisioned

2. Detection & Analysis: Stages 1-4 (Alert Reception through Investigation & Evidence Collection)

3. Containment, Eradication & Recovery: Stage 5 (Containment Recommendations & Escalation)

4. Post-Incident Activity: Stage 6 (Documentation & Knowledge Base Updates)

SANS Incident Response Process Alignment

MITRE ATT&CK Integration Points

• Stage 1: Map alert to initial ATT&CK tactic (Initial Access, Execution, etc.)
• Stage 4: Complete ATT&CK technique mapping across entire attack chain
• Stage 6: Update detection rules aligned to ATT&CK techniques
• Ongoing: Use ATT&CK Browser tool to understand adversary behavior

Best Practices & Common Pitfalls

Best Practices

1. Standardize Triage Procedures

• Use consistent severity classification (P1-P4)
• Create triage checklists for rapid assessment
• Document escalation criteria clearly

2. Automate Where Possible

• Automate IOC enrichment (IP/domain reputation lookups)
• Use SOAR for repetitive tasks (account disables, email purges)
• Leverage AI for initial alert filtering (50% SOC adoption by 2025)

3. Maintain Chain of Custody

• Document all evidence collection
• Hash all forensic artifacts
• Preserve attorney-client privilege when appropriate

4. Communicate Effectively

• Tailor message to audience (technical vs. executive)
• Provide timely updates to stakeholders
• Use visual aids (timelines, network diagrams)

5. Continuously Improve

• Conduct PIRs for all high/critical incidents
• Track metrics (MTTD, MTTI, MTTC, MTTR)
• Update playbooks based on lessons learned

Common Pitfalls

1. Alert Fatigue

• Problem: 90% of SOCs overwhelmed by false positives
• Solution: Aggressive tuning, deduplication, AI-powered filtering

2. Premature Containment

• Problem: Shutting down systems before evidence collection
• Solution: Consult forensics team before powering off systems

3. Scope Creep

• Problem: Investigation expands indefinitely without clear boundaries
• Solution: Define scope early, set investigation time limits

4. Poor Documentation

• Problem: Incomplete incident reports hinder future investigations
• Solution: Use templates, document as you investigate (not after)

5. Lack of Stakeholder Communication

• Problem: IT/business surprised by containment actions
• Solution: Proactive notification before disruptive actions

6. Insufficient Threat Intelligence

• Problem: Reinventing the wheel for known threats
• Solution: Subscribe to quality threat feeds, participate in ISACs

7. No Post-Incident Review

• Problem: Same incidents recurring, no organizational learning
• Solution: Mandatory PIRs for high/critical incidents, track action items

Metrics & KPIs for SOC Alert Triage

Key Performance Indicators

1. Mean Time to Detect (MTTD)

• Definition: Time from initial compromise to alert detection
• Target: <5 minutes for critical threats
• Improvement: Tune detection rules, reduce log ingestion delay

2. Mean Time to Investigate (MTTI)

• Definition: Time from alert to containment decision
• Target: <30 minutes for high-priority alerts
• Improvement: Automate enrichment, improve playbooks

3. Mean Time to Contain (MTTC)

• Definition: Time from alert to full containment
• Target: <1 hour for critical incidents
• Improvement: Pre-authorized containment actions, EDR automation

4. Mean Time to Recover (MTTR)

• Definition: Time from alert to systems fully restored
• Target: <4 hours for high-priority incidents
• Improvement: Improve recovery procedures, maintain clean backups

5. False Positive Rate

• Definition: Percentage of alerts that are false positives
• Target: <20% false positive rate
• Improvement: Continuous rule tuning, deduplication

6. Alert Closure Rate

• Definition: Percentage of alerts closed within SLA
• Target: >95% within SLA
• Improvement: Optimize analyst workflows, automation

7. Escalation Rate

• Definition: Percentage of alerts escalated to IR
• Target: <5% require IR escalation
• Interpretation: Low = good triage, High = missing containment opportunities OR major threat spike

Sample Metrics Dashboard

SOC Alert Triage Metrics - December 2025

Total Alerts: 8,472
  - Critical (P1): 127 (1.5%)
  - High (P2): 847 (10%)
  - Medium (P3): 3,394 (40%)
  - Low (P4): 4,104 (48.5%)

Alert Disposition:
  - True Positive: 1,694 (20%)
  - False Positive: 5,086 (60%)
  - Informational: 1,692 (20%)

Performance:
  - MTTD: 4.2 minutes (Target: <5) ✓
  - MTTI: 28 minutes (Target: <30) ✓
  - MTTC: 52 minutes (Target: <60) ✓
  - MTTR: 3.8 hours (Target: <4) ✓

Escalations:
  - IR Activated: 6 incidents (0.07% of total alerts)
  - L2 Investigations: 1,694 (20%)
  - L1 Resolved: 6,778 (80%)

Top Alert Sources:
  1. EDR - 3,542 alerts (41.8%)
  2. Email Gateway - 2,118 alerts (25%)
  3. Network IDS - 1,694 alerts (20%)
  4. WAF - 847 alerts (10%)
  5. Cloud Security - 271 alerts (3.2%)

Frequently Asked Questions

How do I prioritize alerts when I have hundreds in the queue?

Use a combination of severity classification and business impact:

1. Triage P1/Critical alerts first: Active C2 communications, ransomware, data exfiltration
2. Group similar alerts: Deduplicate 45 "failed login" alerts into one brute-force investigation
3. Leverage automation: Use SOAR or AI to auto-close known false positives
4. Assess business criticality: Alerts on production systems > dev/test environments
5. Time-box investigations: L1 analysts should spend max 15 minutes per alert before escalating to L2

Best Practice: Implement Service Level Agreements (SLAs) for alert response: P1 (15 minutes), P2 (30 minutes), P3 (2 hours), P4 (8 hours).

What should I do if I suspect an alert is a false positive but I'm not certain?

When in doubt, investigate. However:

1. Check the False Positive Database: Has this exact alert pattern been marked FP before?
2. Quick Validation (5 minutes): Look at asset context - is this test environment? Known benign software?
3. Escalate to L2 if uncertain: Better safe than sorry for potential security incidents
4. Document your reasoning: If you close as FP, note why for future reference
5. Track FP patterns: If same alert keeps recurring, create tuning ticket for SIEM engineer

Example: Alert: "PowerShell Execution Detected" on BUILDSERVER-01. Quick check: BUILDSERVER-01 is CI/CD server that routinely runs PowerShell scripts. Validation: Script path is C:\BuildScripts\deploy.ps1 (known good location). Decision: False positive (benign operational activity). Action: Create exception rule for C:\BuildScripts\ on BUILDSERVER-01.

When should I escalate an alert to the Incident Response team?

Escalate immediately for:

Confirmed Incidents:

• Active ransomware or destructive malware
• Confirmed data exfiltration of sensitive data (PII, PHI, PCI, trade secrets)
• Domain controller or critical infrastructure compromise
• Privilege escalation on production systems with lateral movement

Suspected High-Impact Scenarios:

• Multiple failed containment attempts (malware persists despite remediation)
• C-level executive account compromise
• Suspected insider threat
• Media inquiries about potential breach

Compliance-Driven Escalation:

• Potential data breach requiring notification (GDPR 72-hour clock starts)
• Law enforcement notification received
• Regulatory inquiry received

Guideline: If unsure, escalate to SOC Manager who can make IR activation decision. False alarm escalations are acceptable; missed critical incidents are not.

How can I reduce alert fatigue in my SOC?

Alert fatigue is the #1 challenge facing SOCs. Strategies:

Short-Term (Immediate Impact):

1. Aggressive Deduplication: Merge similar alerts (same IOC, same timeframe)
2. Disable Noisy Low-Value Rules: If rule generates 500 alerts/day with 100% FP rate, disable it
3. Raise Thresholds: Instead of "1 failed login = alert", require 5 failures in 5 minutes
4. Whitelist Known-Good: Exclude test environments, CI/CD servers, scheduled jobs

Medium-Term (1-3 months):

1. Implement SOAR: Automate enrichment, IOC lookups, basic containment
2. Tune Detection Rules: Weekly review of top FP generators, adjust rules
3. Context-Aware Alerting: Alert on workstation PowerShell, but not on admin workstations
4. Use Case Review: Are you detecting what matters? Retire low-value use cases

Long-Term (3-6 months):

1. AI-Powered Triage: Deploy AI to validate alerts before human review (50% of SOCs adopting by 2025)
2. Behavioral Analytics: Shift from signature-based to anomaly-based detection
3. Threat Intelligence Integration: Enrich alerts with threat intel to boost confidence scores
4. Analyst Training: Improve analyst skills to investigate faster and more accurately

Metrics to Track: Aim for <20% false positive rate and >80% analyst productivity on true positive investigations.

What's the difference between containment and eradication?

Containment:

• Goal: Stop the spread and prevent further damage
• Actions: Isolate systems, disable accounts, block IPs/domains
• Timing: Immediate (within minutes to hours)
• Analogy: Firefighters creating firebreaks to prevent fire spreading

Eradication:

• Goal: Remove the attacker's presence completely
• Actions: Delete malware, remove backdoors, reset credentials, patch vulnerabilities
• Timing: After containment, can take hours to days
• Analogy: Firefighters extinguishing remaining embers after fire is controlled

Example Scenario:

Incident: Workstation compromised with Emotet malware

Containment:
  - 09:30 - Isolate workstation from network (EDR containment)
  - 09:35 - Disable user account [email protected]
  - 09:40 - Block C2 IP 198.51.100.45 at firewall
  - Result: Malware cannot spread, but still present on workstation

Eradication:
  - 10:00 - Reimage workstation with clean OS
  - 10:30 - Remove scheduled tasks on FILE-SERVER-03
  - 11:00 - Reset passwords for all potentially compromised accounts
  - 11:30 - Patch vulnerability exploited for initial access
  - Result: Attacker presence completely removed

How do I map an alert to the MITRE ATT&CK framework?

MITRE ATT&CK mapping helps you understand attacker objectives and predict next moves.

Step-by-Step Process:

1. Identify the Tactic (What is attacker trying to achieve?): Initial Access? Execution? Persistence? Credential Access? Exfiltration?

2. Find the Technique (How are they achieving it?): Example: Tactic = Execution → Technique = T1059.001 (PowerShell)

3. Use the MITRE ATT&CK Browser Tool (/tools/mitre-attack): Search for observed behavior (e.g., "PowerShell encoded command"), browse technique details to confirm match

4. Document Sub-Techniques (If Applicable): Example: T1059 (Command and Scripting Interpreter) → T1059.001 (PowerShell)

Example Mapping:

Alert: "Suspicious PowerShell Execution"

Observed Behavior:
  - WINWORD.EXE spawned powershell.exe with -encodedCommand parameter

MITRE ATT&CK Mapping:
  - Tactic: Execution (TA0002)
  - Technique: T1059.001 - Command and Scripting Interpreter: PowerShell
  - Sub-Technique: Using encoded commands to evade detection

Why This Matters:
  - Knowing attacker is in "Execution" phase helps predict next steps
  - Likely next tactics: Persistence, Defense Evasion, or Credential Access
  - Prepares SOC to watch for follow-on techniques (T1053 Scheduled Tasks, T1003 Credential Dumping)

What if containment actions will disrupt critical business operations?

This is the classic security vs. business continuity dilemma.

Decision Framework:

Step 1: Assess Risk vs. Business Impact

Step 2: Involve Decision-Makers

• For High Business Impact: Escalate to IT Director, CISO, or CIO
• For Critical Business Impact: Escalate to CEO or COO
• Present Options: "We can (A) shut down now and accept 4 hours downtime OR (B) implement network segmentation for 2 hours downtime with higher risk of spread"

Step 3: Document Decision

Risk Acceptance Form

Incident: Production database server compromise
Recommendation: Immediate shutdown for forensic imaging
Business Impact: 6-hour outage, $200K revenue loss

Decision: Delay containment for 2 hours to complete customer transactions
Approved By: Jane Doe, CIO
Risk Accepted: Potential lateral movement during 2-hour window
Compensating Controls: Network monitoring increased, accounts disabled

Best Practice: Pre-define critical asset lists and pre-authorized containment actions during incident response planning (before incidents occur).

How do I know when an investigation is complete?

An investigation is complete when you can confidently answer these questions:

Scope Questions:

• How did the attacker gain initial access?
• What systems and accounts are compromised?
• Has lateral movement occurred?
• What data (if any) was accessed or exfiltrated?
• Is the attacker still present in the environment?

Containment Questions:

• Have all compromised systems been isolated or remediated?
• Have all compromised credentials been reset?
• Have all attacker persistence mechanisms been removed?
• Have all IOCs been blocked at network perimeter?

Evidence Questions:

• Have all forensic artifacts been collected and preserved?
• Is the timeline of attacker activity documented?
• Are all IOCs cataloged?
• Is the MITRE ATT&CK mapping complete?

Closure Criteria:

• No new alerts related to this incident for 48 hours
• All affected systems scanned and clean
• Incident report completed and reviewed
• Post-incident review conducted
• Detection rules updated to prevent recurrence

When to Extend Investigation:

• New evidence discovered suggesting wider scope
• Attacker activity detected on additional systems
• Forensic analysis reveals previously unknown malware
• Regulatory or legal hold requires extended evidence collection

Related Services

InventiveHQ offers comprehensive security operations services to support your SOC:

1. Security Operations Center (SOC) Services

Link: /services/security-operations-center-soc

What We Offer:

• 24/7 security monitoring and alert triage
• SIEM deployment and optimization
• Detection rule development and tuning
• Threat hunting and proactive defense
• SOC maturity assessments and roadmap development

Why Choose InventiveHQ:

• Expert SOC analysts (L1/L2/L3 tiers)
• Proven methodologies (NIST, SANS, MITRE ATT&CK)
• 90% reduction in Mean Time to Conclusion (MTTC)
• Custom playbooks tailored to your environment

2. 24/7 Detection and Response

Link: /services/24-7-detection-and-response

What We Offer:

• Round-the-clock threat detection powered by CrowdStrike Complete
• Immediate incident response for critical alerts
• EDR deployment, configuration, and management
• Automated containment for high-confidence threats
• Executive reporting and metrics dashboards

Why Choose InventiveHQ:

• CrowdStrike Falcon platform expertise
• <15 minute response time for P1 incidents
• Relentless protection with industry-leading EDR technology

3. Incident Response Planning

Link: /services/incident-response

What We Offer:

• Incident response plan development
• Playbook creation for common scenarios (ransomware, data breach, DDoS)
• Tabletop exercises and IR drills
• Post-incident forensics and analysis
• Breach notification support (GDPR, HIPAA, state laws)

Why Choose InventiveHQ:

• Respond 10x faster with documented procedures
• Meet compliance requirements (NIST, ISO 27001, SOC 2)
• Enterprise-level IR capabilities on a small business budget

Conclusion

SOC alert triage is the frontline defense in modern cybersecurity operations. With nearly 90% of SOCs overwhelmed by alert backlogs and a Mean Time to Conclusion averaging 241 days, structured workflows and automation are no longer optional—they're essential for survival.

This 6-stage workflow provides a battle-tested framework for:

• Rapid Alert Classification: Triage alerts in 1-5 minutes with consistent severity scoring
• Context-Driven Investigation: Enrich alerts with threat intelligence and asset context in 5-15 minutes
• Risk-Based Prioritization: Assess business impact and scope within 10-30 minutes
• Thorough Analysis: Conduct deep-dive investigations with MITRE ATT&CK mapping in 30 minutes to 4 hours
• Effective Containment: Implement balanced containment strategies within 15-60 minutes
• Continuous Improvement: Document findings and improve detection rules in 15-30 minutes

By adopting NIST, SANS, and MITRE ATT&CK best practices, your SOC can:

• Reduce MTTC by up to 90%
• Eliminate alert fatigue through automation and tuning
• Improve analyst productivity by 80%
• Prevent 70%+ of potential breaches through early detection

Remember: Every alert is an opportunity—either to stop an attack in progress or to improve your defenses for the next one. Invest in structured triage processes, leverage automation, and continuously refine your detection capabilities.

Need help building or optimizing your SOC operations? InventiveHQ's security experts can help you implement world-class alert triage workflows, deploy cutting-edge detection technology, and train your team on industry best practices.

Get Started with SOC Services | Enable 24/7 Detection and Response | Build Your Incident Response Plan

Sources

• Dropzone.ai: Alert Triage in 2025 - Complete Guide to 90% Faster Investigations
• Dropzone.ai: Alert Triage Guide 2025
• Dropzone.ai: AI SOC Analysts - The Complete Guide to Alert Management
• Eyer.ai: SIEM Alert Triage: Best Practices for SOCs
• Prophet Security: Mastering Cybersecurity Alert Triage
• Medium: SOC L1 Alert Reporting by Demegorash
• Exabeam: What is MITRE ATT&CK Framework and How Your SOC Can Benefit
• Huntsman Security: Incident Response using MITRE ATTACK
• Graylog: Using MITRE ATT&CK for Incident Response Playbooks
• AuditBoard: NIST Incident Response Guide: Lifecycle, Best Practices & Recovery
• SentinelOne: Incident Response Steps & Phases: NIST Framework Explained
• Logsign: Incident Response Steps for SANS & NIST Frameworks
• SANS Institute: Incident Response Glossary
• NIST SP 800-61r2: Computer Security Incident Handling Guide
• IBM 2025 Cost of Data Breach Report