Alert Triage & Investigation

The item is permanently unanswerable: the telemetry needed for a verdict expired while it waited. Close it as undetermined, never as benign, and pivot to what survives — current resource state and any longer-retention source.

Not the authority to close it. A provider holding only identity telemetry cannot tell an authorised assessment from an intruder, so its contract should grant a short list of unaided actions and hold-and-hand-over for every context-dependent verdict.

Join upward on the parent process GUID, never on the parent process id, because Windows reuses ids and a dead parent's number can be occupied by something unrelated. If the parent's own creation record is missing, the grandparent is unknowable and you say so.

Close it inconclusive rather than leaving it open. Record the population, accounts and per-source window you actually covered, the question still unanswered, the residual risk in plain words, an owner who accepts it, a dated re-check and a trigger that reopens the case.

Because the run explains the mechanism, not the authorisation. The next question is which commit put the key in the configuration repository, who wrote it and who reviewed it. That answer also widens the scope to every host in the group.

Tier note depth by disposition, capture from the tooling what analysts should not retype, mandate a short skeleton rather than a long template, and sample closed cases to test whether a second analyst reaches the same verdict from the note alone.

A detection fired on activity they performed, the activity was verified as authorised, and the case closed as a benign true positive. That record is a statement about the rule, not a finding against the person.

A disposition records one analyst's judgement, not ground truth. Blind re-review a sample, look at the time-to-close distribution, re-check the recorded deciding value against the raw event, and explain the closures that do not fit the majority cluster before requesting any change.

Pivot on entities that outlive the workload: the identity it ran as, the image digest, the pipeline job id, the node. The pod's filesystem and memory are gone, and that is an evidence gap to state, not a clean result.

Not by itself. The owner's word establishes that such automation exists, not that this particular execution was theirs. Ask for something checkable — a job record with a run identifier and window, or the script that matches the decoded argument — then close.

You cannot fix a system you do not own. Price the triage cost in numbers the owning teams answer for, and stop relying on one declared field by deriving ownership from deploy history, on-call rotas and code owners.

Hit rate is the wrong measure. The button's value is the campaigns where a human report was the first signal because the gateway had already delivered the mail, and how fast it arrived. Attack the queue's cost, not the sensor.

Never assert an unworked backlog was benign. Characterise the population, work a random sample to full verdicts, report the estimated true-positive rate with its uncertainty, and state how many items can no longer be adjudicated at all.

With one in-house analyst there is no internal tier to escalate to, so the SOC is tierless by construction. The boundary worth writing is the organisational one with the provider, backed by an incident-response retainer for the depth you cannot staff.