Question

A SOC analyst receives three simultaneous alerts during a busy shift: (1) a single failed login from a marketing user's workstation, (2) unusual outbound traffic from a database server holding customer PII that is also communicating with a known malicious IP, and (3) an antivirus quarantine event on an isolated test VM that has no network connectivity. The organization's incident classification matrix rates impact by data sensitivity, system criticality, and scope. Which alert should the analyst escalate and prioritize first according to sound incident triage practice?

Accepted Answer

The outbound traffic from the PII database server contacting a known malicious IP

Answer

The failed login on the marketing workstation, because credential attacks often precede larger breaches

Answer

The antivirus quarantine event on the isolated test VM, because malware must be eradicated immediately

Answer

All three equally, since every alert must be worked in the order it was received