Question

A SOC analyst receives an automated alert indicating a workstation contacted a known malicious IP. Before escalating to the incident response team, the analyst wants to reduce the chance of escalating a benign event and provide responders with enough context to act quickly. Which action during the detection and analysis phase BEST accomplishes this?

Accepted Answer

Enrich the alert by correlating it with asset criticality, threat intelligence reputation, and related endpoint/proxy logs to validate and contextualize the activity

Answer

Immediately reimage the workstation to eliminate any possible malware before the responders arrive

Answer

Disable the SIEM correlation rule that generated the alert to stop further notifications

Answer

Wait 24 hours to confirm the activity repeats before taking any investigative action