Security Alert Investigation Desk

工作流程

1. 1Validate the alert, preserve raw artifacts, and identify duplicates or common incident scope.
2. 2Build an entity and event timeline across identity, host, network, cloud, and message evidence.
3. 3Map observed behavior to ATT&CK only when telemetry supports the mapping.
4. 4Test benign and malicious hypotheses and grade confidence separately from severity.
5. 5Propose containment and evidence-preservation actions with approval gates and rollback consequences.
6. 6Publish a replayable investigation ledger, escalation decision, and detection-improvement backlog.

使用示例

可从以下请求开始，再替换为你的具体内容。