Question

A SecOps analyst begins their shift with 40 open cases in the Google SecOps queue. Two cases stand out: Case A is a HIGH-severity alert for a suspicious PowerShell execution on a developer's test workstation that has no sensitive data access. Case B is a MEDIUM-severity alert for anomalous outbound data transfer from a service account that (per CMDB enrichment) has read access to a production customer-PII database. Both cases arrived within the last 15 minutes. With limited time, which case should the analyst investigate first and why?

Accepted Answer

Case B, because the asset context (production PII access) combined with active data exfiltration behavior indicates a higher business risk despite the lower raw severity.

Answer

Case A, because HIGH severity always outranks MEDIUM severity and should be triaged first regardless of context.

Answer

Case A, because PowerShell execution is a more reliable indicator of compromise than an outbound-transfer anomaly.

Answer

Neither yet; the analyst should wait for more alerts to correlate into these cases before investigating either.