Security Alert Investigation Desk

ワークフロー

1. 1Validate the alert, preserve raw artifacts, and identify duplicates or common incident scope.
2. 2Build an entity and event timeline across identity, host, network, cloud, and message evidence.
3. 3Map observed behavior to ATT&CK only when telemetry supports the mapping.
4. 4Test benign and malicious hypotheses and grade confidence separately from severity.
5. 5Propose containment and evidence-preservation actions with approval gates and rollback consequences.
6. 6Publish a replayable investigation ledger, escalation decision, and detection-improvement backlog.

使用例

以下のリクエストを出発点にして、詳細を用途に合わせて置き換えてください。