Agent Foskett Academy • SOC Analyst Academy • Module 1 • Lesson 6 • Inside the SOC

Lesson 6 — The Alert Had Five Entities — Which One Do You Pivot On?

The alert looks busy. It contains a user, a device, an IP address, a process and a file. Every one of them could lead somewhere useful.

The question is not whether you can pivot on an entity. The question is which pivot will reduce uncertainty fastest and move the investigation forward.

The best pivot is the entity most likely to answer your next investigation question.

Choose the Pivot Back to SOC Analyst Academy

Agent Foskett SOC Analyst Academy choosing an investigation pivot from alert entities

Five possible pivots

The alert contains a user, device, IP address, PowerShell process and downloaded file. You need to decide which entity gives you the strongest next step.

✓ Identify all alert entities

✓ Match the pivot to the investigation question

✓ Prefer pivots that create context

✓ Avoid chasing weak indicators too early

Case briefing

ALERT Suspicious script execution USER alex.w@contoso.com DEVICE FIN-LT-044 IP ADDRESS 198.51.100.62 PROCESS powershell.exe FILE invoice-update.ps1 FIVE ENTITIES FIVE POSSIBLE PIVOTS THE QUESTION Which one should you investigate first?

Investigation objective

Learn how to choose between multiple alert entities by asking which one is most likely to explain the activity, expose related evidence and create reliable pivots for the next stage of the investigation.

Investigator's rule

Pivot with a purpose. Do not click through every entity simply because it is available. Know what question you are trying to answer before choosing where to go next.

Stage 1 — understand what each entity can tell you

Entity	What it can reveal	Typical limitation
User	Sign-ins, identity risk, privilege, cloud activity, other devices.	Account context does not prove human attribution.
Device	Processes, files, network activity, alerts, other logged-on users.	A busy device can produce a lot of unrelated telemetry.
IP address	Other sign-ins, connections, reputation and recurrence.	Shared infrastructure and NAT can weaken attribution.
Process	Parent/child relationships, command lines, file and network activity.	Requires good process telemetry and context.
File	Hash, origin, prevalence, execution and affected devices.	A file may be renamed, copied or never executed.

Entities answer different questions

If you need to know whether the account was compromised, the user may be the best pivot. If you need to explain execution, the process or device may be better. The same alert can therefore have different correct pivots depending on the question.

Not every entity is equally strong

An external IP may look interesting, but if it belongs to a common cloud provider it may tell you less than the process that actually made the connection.

Stage 2 — start with the process when the alert is about execution

This alert is fundamentally about script execution. The process is therefore a strong first pivot because it can reveal how the activity started and what happened next.

12345 678910 111213141516

let TargetDevice = "FIN-LT-044";
DeviceProcessEvents
| where Timestamp > ago(24h)
| where DeviceName =~ TargetDevice
| where FileName =~ "powershell.exe"
| project Timestamp,
          DeviceName,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          ProcessId,
          InitiatingProcessId,
          SHA1
| order by Timestamp asc

Parent process is often decisive

If PowerShell was launched by outlook.exe, winword.exe or a browser, that creates a very different investigation path from PowerShell launched by an approved management agent.

Command line creates more pivots

A URL, file path, encoded command, script name or remote host in the command line can immediately expose the next entity worth investigating.

Stage 3 — pivot from process to network evidence

Once the process is understood, use it to examine outbound communication from the same device and time window.

12345 678910 1112131415

let TargetDevice = "FIN-LT-044";
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where DeviceName =~ TargetDevice
| where InitiatingProcessFileName =~ "powershell.exe"
| project Timestamp,
          DeviceName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine,
          RemoteIP,
          RemotePort,
          RemoteUrl,
          Protocol
| order by Timestamp asc

Now the IP has context

The external IP becomes more valuable once you know which process contacted it. Instead of asking whether the IP is “bad,” you can ask why PowerShell on FIN-LT-044 communicated with it.

Context before reputation

Threat intelligence can help, but reputation is not a substitute for behaviour. A previously unseen destination contacted by suspicious PowerShell activity can matter even if no reputation service has labelled it malicious.

Stage 4 — pivot to the user when identity becomes the question

If the process activity appears suspicious, determine whether the same user showed unusual authentication or activity around the same time.

12345 678910 1112131415

let TargetUser = "alex.w@contoso.com";
SigninLogs
| where TimeGenerated > ago(24h)
| where UserPrincipalName =~ TargetUser
| project TimeGenerated,
          UserPrincipalName,
          IPAddress,
          Location,
          AppDisplayName,
          DeviceDetail,
          AuthenticationRequirement,
          ConditionalAccessStatus,
          ResultType
| order by TimeGenerated asc

The user can widen the incident

A user pivot may reveal additional devices, cloud activity, risky sign-ins or sessions that were not visible in the original endpoint alert.

Do not pivot forever

Every entity can lead to more entities. Stop expanding when the new pivot no longer helps answer the investigation question or meaningfully changes scope, confidence or response.

Stage 5 — choose pivots in an evidence chain

ALERT Suspicious script execution ↓ PROCESS powershell.exe ↓ PARENT PROCESS browser.exe ↓ COMMAND LINE invoice-update.ps1 ↓ NETWORK 198.51.100.62 ↓ USER alex.w@contoso.com ↓ IDENTITY ACTIVITY sign-ins / sessions / other devices ↓ INCIDENT SCOPE

A good pivot creates context. A great pivot creates the next question.

Which entity should you pivot on?

Your question	Best first pivot	Why
How did the suspicious execution start?	Process	Exposes parent process, command line and execution context.
What else happened on the affected endpoint?	Device	Provides process, file, network and alert history.
Was the account compromised?	User	Opens sign-in, session and cloud activity context.
Did the suspicious process communicate externally?	Process / device	Connects execution directly to network evidence.
Where else did this file appear?	File hash	Helps identify prevalence across devices.
Did this infrastructure touch other accounts?	IP address	Can reveal broader identity or network scope when interpreted carefully.

Write the pivot decision like an analyst

Example: The alert contained five primary entities: user alex.w@contoso.com, device FIN-LT-044, source/destination IP context, powershell.exe and invoice-update.ps1. Because the alert was triggered by suspicious script execution, the initial pivot focused on the PowerShell process to establish parent process, command-line and execution context. That pivot identified related outbound network activity, after which the external destination and user identity were examined to determine wider incident scope. Entity pivots were selected according to the investigation question rather than explored independently.

Lesson 6 key takeaways

Every alert entity is a possible pivot, but not every pivot is equally useful.
Choose the entity most likely to answer the next investigation question.
Process is often the strongest first pivot for execution-based alerts.
Parent process and command-line evidence can reveal new entities immediately.
Network indicators become more meaningful when tied to an initiating process.
User pivots help connect endpoint activity with identity and cloud evidence.
Device pivots are useful for reconstructing a wider local timeline.
File hashes can help establish prevalence across multiple devices.
IP addresses require context because NAT, proxies and shared services can weaken attribution.
Stop pivoting when new entities no longer reduce uncertainty or change the investigation.

Module 1 — inside the SOC

You now know how to choose the most useful entity for the next investigation step. The next question is knowing when you have gathered enough evidence to make a decision.

Next: Lesson 7 — When Do You Stop Investigating?

Continue your SOC Analyst training

Module 1 builds the analyst mindset: triage, evidence collection, entity pivots and defensible investigation decisions.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 1: Inside the SOC: Thinking Like an Analyst

Learn how a SOC analyst chooses useful pivots, reduces uncertainty and follows evidence across identity, endpoint and network telemetry.

← Previous lesson

Lesson 5 — What Evidence Do You Collect First? Build an evidence-first workflow before deciding what the incident means.

✅ Current lesson

Lesson 6 — The Alert Had Five Entities — Which One Do You Pivot On? Choose the most useful user, device, IP, process, file or URL pivot for the next step.

Next lesson →

Lesson 7 — When Do You Stop Investigating? Decide when evidence is sufficient to close, contain, escalate or continue.

How SOC analysts choose an investigation pivot

Lesson 6 of the Agent Foskett SOC Analyst Academy teaches analysts how to choose between users, devices, IP addresses, processes and files when deciding the next step in a security investigation.

Entity pivoting with Microsoft Defender XDR, Entra and KQL

Learn how to follow process, network and identity evidence using targeted KQL queries and select pivots according to the question the investigation needs to answer.