FALSE/TRUE POSITIVE (No further action if false positive)

DG/IPS, Sysmon, Threat intel, SIEM, Source, EDR alerts

True positive: Investigate alerts and host data, gather forensic information and logs, start management of situation

False positive: Investigate alerts and host data, update false positive state decision, gather forensic information if possible

Set preliminary threat level based on available information

Has senior management set a threat level?

Power off machine only at request of senior management

Isolate systems from network (disconnect network)

Confirm and spread IOC from impacted systems to other devices

Patching any exploits that can be remediated

Root to the documentation for full steps in this process

Has the scope of impacted systems increased?

Has Senior received approval escalation to Senior Management?

Evaluate root cause, review team performance, update documentation

flwo