SOC L1 Alert Triage

Overview & Objectives

During this simulation, I took on the role of a Tier 1 SOC Analyst, managing an Alert Queue. The environment displayed five concurrent security events of varying severities, two already closed. The objective was to triage the queue, determine the validity of each alert (True or False Positive), and contain active threats.

Queue Summary and Determination

Case-by-Case Technical Analysis

Case 1: Potential Data Exfiltration (Severe)

5 gigabytes of data found to be sent from a single device to a single destination within one day. Possible data exfiltration to untrusted location.

Destination: *.zoom.us
Sent Data: 5.8 GB
Received Data: 5.2 GB

Determination: False Positive

Analysis: While the data volume triggered the threshold, the destination domain is associated with Zoom and the bidirectional traffic pattern is consistent with video conferencing activity. No evidence was identified suggesting unauthorized data transfer.

Case 2: Double-Extension File Creation (High)

This rule found a creation of a double-extension file, such as ".pdf.exe".

Process Name: chrome.exe
Process User: S.Conway
Target File: C:\Users\S.Conway\Downloads\cats2025.mp4.exe
File MoTW: hxxps://freecatvideoshd.monster/cats2025.mp4.exe

Initially marked as a False Positive because the file had not yet executed. After reviewing the alert logic, I recognized that the rule detects suspicious file creation rather than execution. I updated the determination to True Positive.

Determination: True Positive (Malicious)

Analysis: The user was tricked into downloading a malicious executable disguising itself as a media file via a suspicious external domain (.monster).

Remediation: In a production environment, this file would be quarantined. The host (S.Conway) would be isolated from the network, the malicious process terminated, and the file submitted for sandbox analysis/checking hashes.

Case 3: Download from GitHub Repository (Low)

This rule checks any download from Github.

Accessed URL: hxxps://github[.]com/facebook/react
Source Host: LPT-IT-063
Source Network: VPN/DEVELOPERS

Determination: False Positive

Analysis: The asset context reveals the source host belongs to a developer/from the developer network segment. Accessing a frontend framework repository such as react aligns with standard business operations for this user role.

Operational Takeaways

Context is Critical: An alert is just data. Without cross referencing other sources, false positives can easily mislead an analyst.

Skills Demonstrated

• Alert triage
• False positive analysis
• Threat validation
• Endpoint investigation
• Security event analysis
• Incident response decision making