Alert Triage & Investigation

A false positive means the detection was wrong: the behaviour it claimed to see did not occur. A benign true positive means the detection was right and the behaviour was authorised. One indicts the rule; the other clears it.

The rule and the version that fired, the exact field and value that made the activity benign, the asset and its asset group, and the analyst's reason. A verdict label on its own is not evidence anyone can act on.

Nothing. Criticality and owner tell you what is at stake and who to ask, so they change urgency, routing and the response you may take. Only evidence about the behaviour itself moves a malicious-or-not verdict.

A benign true positive. The behaviour really happened and the rule matched exactly what it was written to match; it was simply authorised. A false positive is a rule firing on activity that never matched its intent at all.

Only that the sending domain authenticated and the signed parts were not altered in transit. It says nothing about intent. An attacker who registers a lookalike domain publishes his own records and passes all three cleanly.

Tier-1 closes only what a written playbook fully covers: expected activity and known false-positive patterns. Anything the playbook does not cover, anything suggesting the adversary succeeded rather than merely tried, and anything on a critical asset goes to tier-2.

The entity fields: the service-account username, the object's namespace and name, the source IP, and the user agent. Each becomes a search across other sources inside a time window. The audit ID only links stages of that one request.

The parent chain says who asked for it. Encoded PowerShell under a document application means a user opened something that executed code; the same command under a management agent's service means scheduled automation. The lineage, not the child, carries the verdict.

Scope has three axes: how many hosts carry the same artefact, which accounts it grants access to, and over what time window you can see. One host with no accounts and no time bound is a finding, not a scope.

A change record proves only that a ticket exists with a stated scope, requester and approver. Join it to the activity on four axes - time, scope, identity and approval path - before it counts as corroboration, and never as authorisation.

Work order decides which 260 you never examine, not how many you finish. Order by what a late look costs: evidence about to expire, high blast-radius accounts and identities, and stages of an intrusion you cannot undo.

Hand over the hypothesis, not just the facts: what you think is happening and how sure you are, the evidence both ways, what you deliberately did not do and why, and the threshold at which the incoming analyst escalates without waiting for you.

Only that the behaviour is common in that population. Prevalence measures a base rate, not authorisation. It can lower your suspicion cheaply, but only if those 412 hosts are comparable to the alerting one, and it never proves anything is malicious.

Search the mail trail on the campaign's stable elements, not the exact subject, over a window that opens before the report. Then split recipients into those who merely received it and the few with evidence of acting.

The one whose result would change your next decision, weighted by how selective it is. In a build-infrastructure intrusion that is normally the image digest, then the token id; a shared or NAT'd source address answers least and usually runs last.

A closed false positive is a verdict somebody reached. An unopened detection is the absence of a verdict: it tells you about the SOC's capacity, not about the estate, and it can never be counted as benign.

Because a conclusion is not evidence. A zero-result search only means something if the note records what was searched, over what window and which sources - otherwise a later reader cannot tell a clean host from a blind spot.

The rule was not wrong. It reported the transfer exactly as it happened; only a signed contract makes the transfer acceptable. A false-positive label records a working detection as defective, and defective detections get narrowed or retired.

Aggregate the closures into a claim: which field decided them, how often, and on which asset groups. Add a handful of exemplar records, state what the rule did catch that was real, and hand it to a named owner. Supply the evidence, not the rewrite.

It describes the rule's content: how bad that behaviour would be in general, judged by an author who has never seen your estate. This alert's severity also depends on the host, the account and how ordinary the behaviour is here.

A benign true positive, not a false positive: the reporters correctly spotted phishing-shaped mail and the campaign really is ours. Confirm it from the mail trail rather than from marketing's word, close the thirty-one as one case, and answer every reporter.

Triage the application, not the mail. The link ends at your own identity provider's real consent page, so reputation looks clean; the evidence is the client id, the scopes, the reply URL, and whether anyone already granted it.

A stated hypothesis, every lookup already run and what each returned including the negative results, what was deliberately not checked, any action already taken on the estate, and the exact identifiers and time window. Tier-2 inherits an investigation, not a ticket.

Only that both events authenticated as the same identity. If every pipeline uses that account, the link is nearly worthless. It becomes evidence when a second, more selective entity such as an image digest is shared too.

Compare the roots, not the leaves. One chain is rooted at an interactive user's document application; the other at the service control manager starting a management agent as SYSTEM in session 0. Identical children, different causes, opposite verdicts.

Set the window per source, not once for the case. auditd answers only its 14 days; reach further with config-management history, archived sshd authentication logs, bastion logs and host backups, and record whatever stays unreachable as a stated gap.

Record the authorised activity, not a suppression: who owns it, the exact combination permitted, the evidence that authorises it, and an expiry or review date. The alert keeps firing and keeps being reviewed - it just resolves in minutes.

Because reporting cost more than closing and produced no visible result. Ninety seconds a night is cheaper than finding an owner two org units away, and analysts are measured on time-to-close, not on rules improved. The real damage is the trained reflex.

Ask which hypothesis the call tests. Under a stolen-credential hypothesis, reaching the real person is fast and safe. If that person is the possible subject, the call warns them, and the decision belongs to the incident lead with legal and HR.