Agent Foskett Academy • SOC Analyst Academy • Module 2 • Lesson 19 • Alert Triage

Lesson 19 — The Alert Needed More Context Before a Verdict

The alert looked suspicious enough to investigate, but not suspicious enough to call malicious.

A user had launched PowerShell. The command contacted an external destination. Nothing had been blocked. There was no obvious malware, no confirmed credential theft and no clear business explanation.

The analyst did not need more data everywhere. The analyst needed the right missing evidence.

When you cannot decide, identify the evidence that would change the decision.

Find the Missing Context Back to SOC Analyst Academy

Agent Foskett SOC Analyst Academy gathering additional evidence before a verdict

Suspicious is not a verdict

The analyst's next job is to determine which unanswered question matters most — and collect evidence that can answer it.

✓ State what is known

✓ Identify the uncertainty

✓ Ask the smallest useful question

✓ Stop when the decision is defensible

Case briefing

14:26 — MEDIUM ALERT DEVICE HR-LT-031 USER a.wilson PROCESS powershell.exe COMMAND Downloads content from an external URL DETECTION RESULT Suspicious scripting activity WHAT WE KNOW PowerShell executed External communication occurred User session was active WHAT WE DO NOT KNOW Was the command expected? What launched PowerShell? What was downloaded? Did the file execute? Has this user done this before? VERDICT? NOT YET.

Investigation objective

Identify the minimum additional evidence required to move from uncertainty to a defensible close, contain, escalate or continue decision.

Investigator's rule

Do not collect evidence without a question. Every pivot should reduce a specific uncertainty in the investigation.

Stage 1 — separate facts from unanswered questions

Current fact	Unanswered question
PowerShell executed	What process launched it?
An external URL was contacted	Was the destination expected or previously seen?
Content was downloaded	What file was created?
The user was logged on	Did the user intentionally perform the action?
No malware verdict exists	Did the downloaded content execute or create follow-on activity?

More telemetry is not always better

A broad hunt across weeks of unrelated data may create hundreds of observations without answering the one question that determines the verdict.

Prioritise decision-changing evidence

If discovering that Word launched PowerShell would materially change your assessment, process ancestry is more valuable right now than collecting every network event on the device.

Stage 2 — ask the first decision-changing question

QUESTION 1 WHAT LAUNCHED POWERSHELL? POSSIBLE ANSWER A Approved management agent ↓ Supports legitimate administration POSSIBLE ANSWER B User opened known internal script ↓ Needs validation POSSIBLE ANSWER C WINWORD.EXE ↓ Raises concern immediately ONE QUESTION. THREE VERY DIFFERENT INVESTIGATION PATHS.

Stage 3 — inspect process ancestry with KQL

Start with the alert time and reconstruct the execution context around PowerShell.

12345 678910 11121314

let TargetDevice = "HR-LT-031";
DeviceProcessEvents
| where Timestamp between (
    datetime(2026-08-23 14:20:00) ..
    datetime(2026-08-23 14:35:00)
)
| where DeviceName =~ TargetDevice
| project Timestamp,
          AccountName,
          FileName,
          ProcessCommandLine,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| order by Timestamp asc

The first answer changes the case

The query shows that WINWORD.EXE launched PowerShell. That does not prove malicious activity, but it makes the execution substantially harder to explain as routine administration.

Now ask the next question

Investigation should be iterative. Once process ancestry raises concern, the next useful question becomes: what did PowerShell download, and what happened to it?

Stage 4 — follow the downloaded file

14:25:52 WINWORD.EXE ↓ 14:26:03 powershell.exe ↓ 14:26:05 External URL contacted ↓ 14:26:07 invoice_update.zip created ↓ 14:26:18 Archive extracted ↓ 14:26:24 update.exe appears NEW QUESTION DID update.exe EXECUTE?

Stage 5 — correlate file creation and execution

Now the investigation has a specific filename. Search for file creation and process execution instead of continuing with a broad hunt.

12345 678910 1112131415 161718

let TargetDevice = "HR-LT-031";
let TargetFile = "update.exe";
union
(
    DeviceFileEvents
    | where DeviceName =~ TargetDevice
    | where FileName =~ TargetFile
    | project Timestamp, EventType="File",
              FileName, FolderPath, SHA1
),
(
    DeviceProcessEvents
    | where DeviceName =~ TargetDevice
    | where FileName =~ TargetFile
    | project Timestamp, EventType="Process",
              FileName, FolderPath, SHA1
)
| order by Timestamp asc

The evidence crosses a threshold

The file was not merely downloaded. `update.exe` executed seconds later. Combined with Word launching PowerShell, the evidence now supports escalation without needing to know every detail of the attack first.

You do not need perfect certainty

A defensible SOC decision is not the same as complete forensic reconstruction. Once the evidence supports containment or escalation, delaying action for unnecessary certainty can increase risk.

Stage 6 — know what evidence is enough

Decision	Minimum evidence might include
Close as expected	Known activity, expected process ancestry, approved user/action and no unexplained follow-on behaviour.
Continue investigating	Suspicion remains, but a specific unanswered question could materially change the verdict.
Escalate	Multiple suspicious facts align and specialist or higher-tier investigation is warranted.
Contain	Evidence indicates credible active compromise or unacceptable ongoing risk.

Avoid endless investigation

Analysts can keep finding new questions forever. The goal is not to remove every uncertainty. The goal is to reduce the uncertainties that matter to the decision.

Document what remains unknown

If you escalate before every question is answered, record the unresolved items clearly. The next analyst should know what is established, what is inferred and what still needs validation.

Stage 7 — build the minimum-context workflow

ALERT ↓ WHAT DO I KNOW? ↓ WHAT IS UNCERTAIN? ↓ WHICH UNCERTAINTY COULD CHANGE MY DECISION? ↓ ASK ONE FOCUSED QUESTION ↓ COLLECT THE SMALLEST USEFUL SET OF EVIDENCE ↓ DID THE ANSWER RESOLVE THE DECISION? ↓ NO → ASK THE NEXT QUESTION YES → CLOSE / CONTAIN / ESCALATE ↓ DOCUMENT REMAINING UNCERTAINTY

Good investigation is not collecting everything. It is knowing what evidence you need next.

Write the triage finding

TRIAGE FINDING A Medium alert identified PowerShell downloading content from an external destination on HR-LT-031. Initial evidence was insufficient for a defensible malicious or benign verdict. Targeted investigation established that: • WINWORD.EXE launched PowerShell • PowerShell downloaded invoice_update.zip • The archive produced update.exe • update.exe executed seconds later DECISION Escalate and contain the endpoint. The evidence is sufficient to justify action even though the complete purpose and capability of update.exe have not yet been established. OUTSTANDING Determine file reputation and behaviour Assess credential exposure Check for activity on additional devices

Lesson 19 key takeaways

Suspicious activity does not automatically provide enough evidence for a verdict.
Separate established facts from unanswered questions.
Prioritise evidence that could materially change the decision.
Do not collect telemetry without knowing what question it should answer.
Use focused KQL pivots to reduce uncertainty step by step.
Process ancestry can radically change the interpretation of a scripting alert.
Follow downloaded files into creation and execution evidence.
You do not need complete forensic certainty before escalating or containing credible risk.
Stop investigating when the evidence is sufficient for a defensible operational decision.
Document remaining uncertainty so the next analyst knows exactly what is unresolved.

Module 2 — alert triage

You have now learned how to identify exactly what evidence is missing before reaching a verdict. Next, Agent Foskett brings the entire module together into a repeatable SOC triage workflow.

Next: Lesson 20 — Building a Repeatable SOC Triage Workflow

Continue your SOC Analyst training

Module 2 focuses on alert triage, evidence gaps, prioritisation, correlation and defensible SOC decisions.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 2: Alert Triage — Deciding What Matters First

Identify the minimum additional evidence needed before making a defensible SOC decision.

← Previous lesson

Lesson 18 — The Incident Queue Was Growing Faster Than We Could Clear It Prioritise under pressure without simply sorting by severity.

✅ Current lesson

Lesson 19 — The Alert Needed More Context Before a Verdict Identify the minimum additional evidence needed for a defensible decision.

Next lesson →

Lesson 20 — Building a Repeatable SOC Triage Workflow Turn individual triage skills into a consistent operational process.

How much evidence does a SOC analyst need before a verdict?

Lesson 19 of the Agent Foskett SOC Analyst Academy teaches analysts how to identify evidence gaps, ask decision-changing investigation questions and collect the minimum additional context required for a defensible security decision.

KQL evidence collection for Microsoft Defender XDR investigations

Learn how to use DeviceProcessEvents and DeviceFileEvents to investigate process ancestry, follow downloaded files and determine when security evidence is sufficient to close, contain, escalate or continue an investigation.