: Enrich the alert with User and Entity Behavior Analytics (UEBA) to see if the user’s actions deviate from their baseline.
Key assumptions (reasonable defaults):
Credential theft + C2 beaconing.
A structured approach ensures that no stone is left unturned. Most elite SOCs follow a variation of the following cycle: Data Gathering (The Evidence) Collect all relevant telemetry. This includes: