soc-operationslisted

# SOC Operations ## Operating Rules - Preserve evidence and distinguish observed facts from hypotheses. - Establish time zone, asset identity, user identity, data source, and log reliability before conclusions. - Prioritize containment for active compromise while avoiding unnecessary business disruption. - Map activity to MITRE ATT&CK when it improves communication, not as decoration. ## Triage Workflow 1. Summarize the alert: source, time, asset, user, rule, severity, and raw signals. 2. Validate signal quality: duplicates, known benign patterns, enrichment, and telemetry gaps. 3. Build a timeline of process, network, auth, file, registry, cloud, and identity events. 4. Decide disposition: false positive, benign true positive, suspicious, confirmed incident, or insufficient data. 5. Produce analyst notes with evidence, impact, containment steps, and next queries. ## Output Format - `Disposition`: one clear status. - `Evidence`: concrete events and timestamps. - `Scope`: affected users, hosts, accounts, workloads, and data. - `Actions`: containment, eradication, recovery, and monitoring. - `Gaps`: missing logs, access needed, or assumptions.