Security Event Triage

  1. Common Alert Types and Triage Approaches
    1. Malware and Ransomware Alerts
      1. Initial Infection Vectors
        1. Email Attachments
          1. Drive-by Downloads
            1. Removable Media
            2. Lateral Movement Indicators
              1. Network Scanning
                1. Credential Harvesting
                  1. Remote Access Tools
                  2. Ransom Note Detection
                    1. File Extension Changes
                      1. Encryption Indicators
                        1. Ransom Demands
                      2. Phishing and Email-Based Attacks
                        1. Suspicious Email Characteristics
                          1. Sender Reputation
                            1. Subject Line Analysis
                              1. Content Anomalies
                              2. Credential Harvesting Attempts
                                1. Fake Login Pages
                                  1. Social Engineering Tactics
                                2. Brute Force and Password Spraying Attacks
                                  1. Repeated Login Failures
                                    1. Failure Rate Analysis
                                      1. Account Targeting Patterns
                                      2. Account Lockout Events
                                        1. Lockout Frequency
                                          1. Affected Account Analysis
                                          2. Source IP Analysis
                                            1. Geographic Distribution
                                              1. IP Reputation
                                            2. Web Application Attacks
                                              1. SQL Injection (SQLi)
                                                1. Unusual Query Patterns
                                                  1. Database Error Messages
                                                    1. Input Validation Bypasses
                                                    2. Cross-Site Scripting (XSS)
                                                      1. Script Injection Detection
                                                        1. User Impact Assessment
                                                          1. Payload Analysis
                                                          2. Command Injection
                                                            1. System Command Execution
                                                              1. Parameter Manipulation
                                                              2. Directory Traversal
                                                                1. Path Manipulation Attempts
                                                                  1. File Access Patterns
                                                                2. Denial-of-Service (DoS) Attacks
                                                                  1. Traffic Volume Analysis
                                                                    1. Bandwidth Utilization
                                                                      1. Request Rate Monitoring
                                                                      2. Service Availability Monitoring
                                                                        1. Response Time Degradation
                                                                          1. Service Outages
                                                                          2. Source Distribution
                                                                            1. Attack Vector Analysis
                                                                              1. Botnet Identification
                                                                            2. Data Exfiltration Attempts
                                                                              1. Unusual Data Transfers
                                                                                1. Large File Movements
                                                                                  1. Compressed Archive Creation
                                                                                  2. Use of External Storage or Services
                                                                                    1. Cloud Storage Access
                                                                                      1. External Device Usage
                                                                                      2. Data Volume Thresholds
                                                                                        1. Baseline Comparison
                                                                                          1. Anomaly Detection
                                                                                        2. Insider Threat Activity
                                                                                          1. Privileged User Monitoring
                                                                                            1. Administrative Actions
                                                                                              1. Access Pattern Changes
                                                                                              2. Unusual Data Access
                                                                                                1. After-Hours Activity
                                                                                                  1. Sensitive Data Queries
                                                                                                  2. Policy Violation Patterns
                                                                                                    1. Unauthorized Software Installation
                                                                                                      1. Data Handling Violations
                                                                                                    2. Policy Violation Alerts
                                                                                                      1. Unauthorized Application Use
                                                                                                        1. Shadow IT Detection
                                                                                                          1. Prohibited Software
                                                                                                          2. Data Handling Violations
                                                                                                            1. DLP Policy Triggers
                                                                                                              1. Compliance Breaches
                                                                                                              2. Compliance Breach Indicators
                                                                                                                1. Regulatory Requirement Violations
                                                                                                                  1. Audit Trail Gaps

                                                                                                              Previous

                                                                                                              6. Prioritization Frameworks and Models

                                                                                                              Go to top

                                                                                                              Next

                                                                                                              8. Documentation and Communication