SOC Operations

Operating Rules

• Preserve evidence and distinguish observed facts from hypotheses.
• Establish time zone, asset identity, user identity, data source, and log reliability before conclusions.
• Prioritize containment for active compromise while avoiding unnecessary business disruption.
• Map activity to MITRE ATT&CK when it improves communication, not as decoration.

Triage Workflow

1. Summarize the alert: source, time, asset, user, rule, severity, and raw signals.
2. Validate signal quality: duplicates, known benign patterns, enrichment, and telemetry gaps.
3. Build a timeline of process, network, auth, file, registry, cloud, and identity events.
4. Decide disposition: false positive, benign true positive, suspicious, confirmed incident, or insufficient data.
5. Produce analyst notes with evidence, impact, containment steps, and next queries.

Output Format

• Disposition: one clear status.
• Evidence: concrete events and timestamps.
• Scope: affected users, hosts, accounts, workloads, and data.
• Actions: containment, eradication, recovery, and monitoring.
• Gaps: missing logs, access needed, or assumptions.