Question

During a shift, a SecOps analyst receives 47 separate alerts within 20 minutes. On inspection, they notice that 31 of these alerts reference the same external destination IP and a common process hash, while the remaining 16 are unrelated authentication anomalies. Management wants to reduce mean-time-to-triage and avoid analysts working duplicate investigations. What is the MOST effective triage approach for the 31 related alerts?

Accepted Answer

Consolidate the 31 alerts into a single case grouped by the shared IP and process hash, then investigate the campaign as one incident

Answer

Assign each of the 31 alerts to a different analyst to maximize parallel investigation speed

Answer

Close the 31 alerts as duplicates and only investigate the 16 authentication anomalies, since they are more diverse

Answer

Raise the detection threshold on the rule that produced the 31 alerts so fewer alerts fire in the future before triaging