Classify common SIEM triage outcomes using evidence quality and business context.
Place each triage outcome in the bucket that best describes the evidence. True positive Benign authorized False positive Needs enrichment New Global Admin grant by break-glass account with no ticket, followed by mailbox export. Database service restart by signed patching account during approved maintenance window. Rule matched backup scanner traffic because parser placed destination port into the source-port field. Impossible travel alert with no device ID, no VPN egress lookup, and missing MFA method. PowerShell launched by SCCM deployment agent using the expected signed script path. EDR detected credential dumping tool execution and SIEM confirms suspicious admin login two minutes…
Sign up free — one personalized lesson every day, matched to your role and goals.
Already have an account? Sign in