Security Alert Investigation Desk

작업 진행 방식

1. 1Validate the alert, preserve raw artifacts, and identify duplicates or common incident scope.
2. 2Build an entity and event timeline across identity, host, network, cloud, and message evidence.
3. 3Map observed behavior to ATT&CK only when telemetry supports the mapping.
4. 4Test benign and malicious hypotheses and grade confidence separately from severity.
5. 5Propose containment and evidence-preservation actions with approval gates and rollback consequences.
6. 6Publish a replayable investigation ledger, escalation decision, and detection-improvement backlog.

사용 예시

아래 요청을 시작점으로 삼고 세부 내용을 상황에 맞게 바꾸세요.