Four hours into an unexplained SSH key case with no second host and no execution — how do you close it?

## Why a time box exists at all Analyst hours are the scarce resource in a SOC, and every hour spent widening one ambiguous artefact is an hour the rest of the queue does not get — and those alerts are also real. An investigation with no stopping rule does not end in a verdict; it ends when the analyst runs out of energy or the shift ends, which is the worst of both outcomes because nothing is recorded and nobody owns what is left. So the discipline is: decide *before you widen* what would make you escalate and what would make you stop. Written down, with a rough budget. That pre-commitment does two things — it stops the open-ended dig, and it makes the eventual close defensible to someone reading the case later. ## "Inconclusive" is a real outcome, and it has its own label Three case labels are routinely confused, and they are not interchangeable: - **False positive** — the detection was wrong about the activity being suspicious. - **Benign true positive** — the activity genuinely happened and was authorised. - **Inconclusive** — the evidence available did not decide either way. Stamping an inconclusive case as a false positive is the common and damaging move. It feeds a tuning signal that the rule misfires, and it tells the next analyst — and the next one after a re-alert — that this was already looked at and was nothing. Say what you actually mean: you could not determine it, within the scope and window you covered. ## What the close record has to contain Write it for the person who picks this up in six weeks, not for a metric: 1. **Scope actually covered.** Be specific: which hosts ("the twelve hosts in configuration group `app-prod`"), which accounts, which sources and the window each one could answer. Vagueness here is what makes a later re-alert start from zero. 2. **The unanswered question, stated as a question.** "When was this key added, and by whom?" — not "no evidence of compromise found", which reads as a finding of absence and is not one. 3. **The residual risk, in plain business language.** "An unattributed public key grants shell access as the application service account on twelve production hosts." That sentence is the only part a non-analyst will read. 4. **What was done and by whom.** Any remediation decision belongs to whoever owns that call; the case records it rather than assuming it. 5. **An owner and a re-check date.** Residual risk needs someone who accepts it, and a date is a commitment where "we'll keep an eye on it" is not. 6. **A reopen trigger.** Concretely: any further write to that `authorized_keys` path, the same public key appearing on another host, or an authentication accepted for that key's fingerprint. This converts a manual intention into something the estate will tell you about. ## The two failure modes it prevents **The open case nobody returns to.** It has no owner, no date and no trigger. It sits in "in progress" distorting the queue, and the ambiguity that started it never gets resolved — it just stops being visible. **The reassuring close.** "No evidence of compromise" without stating what was searched and over what period is a sentence that sounds like a conclusion and contains none. If someone quotes it back to you in three months when the same key turns up on another host, you want the record to say exactly which hosts and which window you covered, so the gap is visible rather than implied. ## Handing it over A time-boxed close is also a handoff. The next reader inherits a hypothesis, not just a status: what you believed, what you checked, what you could not check and why. Written that way, a re-alert costs twenty minutes to reassess instead of another four hours to redo. ## The sentence to be able to say "I spent four hours on it, covered twelve hosts, three accounts and every source that reaches back past the key's timestamp, and I still cannot say when it was added or by whom. Here is the residual risk, here is who accepts it, here is the date I look again, and here is what will page us before then." That is a complete answer, and it is a defensible one.