Triage that names the evidence

1. Ticket hook — 47 High, one DC

Night shift. The SIEM queue shows 47 High notables. Forty of them are “SMB lateral movement” from 10.20.8.14 — the Qualys scanner that always runs at 02:00. One is “LSASS memory access” on DC01 by svc-backup at 02:11. A junior wants to close the forty as False Positive with no comment and page IR for every remaining High.

That is the interview. NIST SP 800-61r3 is explicit: triage, prioritization, and escalation follow risk — asset criticality and impact — not the color of the first card. Microsoft Sentinel and Splunk ES both force a close classification. “False Positive” is not a synonym for “I am tired.” The scanner is likely a benign positive (suspicious but expected). The LSASS handle on a domain controller is a different ticket.

Hero · who talks to whom

2. Mental model: event → alert → incident

Interviewers mix these three words on purpose. Keep them on different layers. NIST SP 800-92’s SIEM picture is still the right spine: collect → filter / aggregate → normalize → correlate → prioritize → respond. The dashboard is the last station, not the first proof.

SOC tiers sit on that spine. L1 follows the playbook: validate, classify, contain only what the runbook allows, escalate. L2 hunts the chain, scopes hosts and identities, recommends containment. L3 / IR owns malware, threat-intel attribution, and recovery decisions. Do not pretend L1 “investigates ransomware.” Do not dump a High card on IR with no entities.

Path · five stations

3. Triage decision flow

Flowchart first. You do not start by changing severity. You start by proving the telemetry exists, then you ask whether the activity is malicious, expected, or a broken rule.

Decision · two paths

4. How to classify and escalate

Use the vendor words in the room. Microsoft Sentinel’s mandatory close list is: True Positive – suspicious activity, Benign Positive – suspicious but expected, False Positive – incorrect alert logic, False Positive – incorrect data, Undetermined. Splunk ES 8 findings use the same four ideas (True Positive – Suspicious Activity, Benign Positive – Suspicious But Expected, plus the two false-positive reasons).

When L1 must escalate

Escalate when any one of these is true, and take the evidence pack with you: confirmed credential dump (T1003 / T1003.001), lateral movement off a foothold, a privileged or service account, a domain controller / identity / backup / OT crown jewel, suspected ransomware or data staging, or anything the playbook says “stop — IR.” Do not escalate “because it is High.” Do not sit on LSASS-on-DC “because EDR is noisy.”

5. Do: notable → hunt → close or page

Primary sources for this block: Microsoft Sentinel “Investigate incidents” + “Handle false positives”; Splunk ES Incident Review dispositions; NIST SP 800-61r3 (triage / escalate on risk). Vendor consoles differ. The order does not.

Side A — Read the notable, not the color

1. Claim the card and freeze the clock

   Assign the incident to yourself. Note first event time, last event time, rule name, and severity. Severity is a hint. First-event time is the start of your hunt window.

2. Write the entities on paper

   Host / dest, source / src, user, process or hash, signature or analytic name, MITRE technique if tagged. If a required field is empty, stop — that is a parse problem, not a closed true positive.

3. Open the raw contributing events

   Incident Review / Incidents → the notable → contributing events. You need the Windows Event ID, Sysmon ID, or EDR action — not the dashboard sentence.

Side B — Hunt one hop left and one hop right

1. Confirm the process, not the rule title

   For T1003.001 you want a non-expected process opening lsass.exe with dump-level access, or a dump file write. ATT&CK DET0363 describes that sequence. A backup agent that is supposed to read LSASS is a different story than rundll32.exe calling comsvcs.dll MiniDump.

2. Pivot 30–60 minutes on the same host and user

   Same dest: 4624 logons, 4688 / Sysmon 1 process creates, 4769 Kerberos, outbound C2, SMB to other DCs. Same user: other hosts. A single technique tag is a hint; a chain is the case.

3. Map tactic → technique → procedure out loud

   Tactic = why (TA0006 Credential Access). Technique / sub-technique = how (T1003.001 LSASS Memory). Procedure = this binary, this command line, this dump path. Interviewers fail people who say “it’s MITRE lateral movement” with no ID.

index=wineventlog OR index=edr dest=DC01
  earliest=-30m@m latest=+30m@m
| table _time dest src user signature process parent_process file_path
| sort _time

Side C — Classify, then stop or page

1. Pick one official close reason

   Sentinel / Splunk ES language only. Benign scan ≠ false positive. Undetermined if you lack logs — say which index or sensor is dark.

2. If true positive and in playbook: contain, then write the pack

   L1 containment is whatever the runbook already allows (isolate a workstation, disable a named user after approval). Domain controller isolation is almost never an L1 solo call. Escalate with: entities, timeline, MITRE IDs, raw event IDs, what you already did, what you need IR to do.

3. If benign or false: leave a replayable comment and a tune ticket

   Microsoft’s preferred FP path is a time-bound automation rule or a watchlist exception, default expiry 24 hours unless SOC engineering owns a permanent query change. Closing 40 cards with no comment is how the next shift re-opens them.

6. Runtime path after go-live

After a rule is in production, the interesting tickets are almost always missing parse, wrong close reason, or a chain the single analytic cannot see — not “the SIEM is down.”

Ops · proof desk

7. Eight interview scenarios

Each one is a production ticket. Answer with the direct line, then the evidence. Weak answers change severity, disable the rule, or page IR with no entities.

8. Traps and proof checklist

Sources

• NIST SP 800-61 Rev. 3 — Incident Response Recommendations (CSF 2.0 Community Profile); triage, prioritization, escalation on risk
• NIST SP 800-61r3 PDF
• NIST SP 800-61 Rev. 2 — four-phase IR lifecycle still asked in interviews
• NIST SP 800-92 — Guide to Computer Security Log Management (SIEM collect, normalize, correlate, prioritize)
• MITRE ATT&CK® — Enterprise matrix (tactic / technique / procedure)
• ATT&CK T1003.001 — OS Credential Dumping: LSASS Memory
• ATT&CK T1021.002 — Remote Services: SMB/Windows Admin Shares
• ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell
• Microsoft Learn — Handle false positives in Microsoft Sentinel (automation vs query; 24h expiry; watchlists)
• Microsoft Learn — Investigate incidents (close classifications: TP / benign / FP logic / FP data / undetermined)
• Splunk ES 8 — Configure dispositions for findings (True Positive / Benign Positive / False Positive reasons)
• Splunk ES 7 — Triage notables on Incident Review
• CISA — Federal Government Cybersecurity Incident and Vulnerability Response Playbooks

Related: Wireshark interview · Linux interview · VAPT interview · SOC 2.0 AI triage · Interview hub