Agent Foskett Academy • SOC Analyst Academy • Module 1 • Lesson 7 • Inside the SOC

Lesson 7 — When Do You Stop Investigating?

Investigations can expand forever if you let them. Every user leads to another sign-in. Every device leads to another process. Every process leads to another file, IP address or child process.

A good analyst is not the person who collects the most telemetry. A good analyst knows when the available evidence is sufficient to make a defensible decision.

Stop when the evidence supports a decision — not when there is nothing left to query.

Make the Decision Back to SOC Analyst Academy

Agent Foskett SOC Analyst Academy deciding when to stop an investigation

The investigation is still growing

You have identity, process and network evidence. More pivots are available, but the important question is whether they are still capable of changing the outcome.

✓ Define the decision you need to make

✓ Separate useful evidence from curiosity

✓ Identify unresolved high-impact questions

✓ Close, contain, escalate or continue

Case briefing

INCIDENT STATUS USER alex.w@contoso.com DEVICE FIN-LT-044 CONFIRMED ✓ successful sign-in ✓ suspicious PowerShell execution ✓ outbound connection from PowerShell ✓ user does not recognise the activity NOT YET CONFIRMED ? persistence ? credential theft ? lateral movement ? data access ? second affected device AVAILABLE PIVOTS Many THE QUESTION Do you keep hunting — or do you already have enough evidence to act?

Investigation objective

Learn how to decide whether an investigation has enough evidence to support closure, containment, escalation or continued analysis, without confusing thoroughness with endless investigation.

Investigator's rule

Every investigation needs a decision point. If another query cannot realistically change the decision, it may not be the next best use of analyst time.

Stage 1 — define the decision before collecting more evidence

Decision	What you need to know
Close as benign	Is there a validated legitimate explanation that accounts for the evidence?
Contain	Is there enough evidence of active or likely compromise to justify disrupting the user/device?
Escalate	Does scope, impact, privilege or uncertainty require higher-level response?
Continue investigating	Is there an unanswered question that could materially change the outcome?

Investigation is not a completeness contest

You rarely need to explain every event in the environment. You need enough evidence to understand the security significance of the activity and make the next operational decision.

Unknown does not always mean continue

Some uncertainty is normal. If you already have strong evidence of compromise, proving every possible attacker action before containing the device may create unnecessary risk.

Stage 2 — identify the questions that could change the outcome

QUESTION 1 Was the PowerShell activity legitimate? → YES could close the case → NO supports compromise → HIGH VALUE QUESTION QUESTION 2 Did the attacker rename a temporary file? → Interesting → unlikely to change containment decision → LOWER VALUE QUESTION QUESTION 3 Did the account access another device? → Could expand incident scope → HIGH VALUE QUESTION QUESTION 4 What was every network connection on the laptop today? → Too broad without a specific hypothesis → LOW VALUE RIGHT NOW

Prioritise decision-changing evidence

A useful question has the power to change disposition, scope, urgency or response. If it cannot do that, it may belong later in the investigation or not at all.

Curiosity is not a response plan

Analysts naturally want to know more. Curiosity is valuable in hunting, but incident response requires prioritisation. Ask whether the next pivot serves the incident.

Stage 3 — use KQL to answer one final scope question

One unresolved question could materially change the incident: did the same account appear on another device around the suspicious activity? A focused KQL query can answer that without opening an entirely new investigation branch.

12345 678910 1112

let TargetUser = "alex.w@contoso.com";
DeviceLogonEvents
| where Timestamp > ago(24h)
| where AccountUpn =~ TargetUser
| summarize
    FirstSeen=min(Timestamp),
    LastSeen=max(Timestamp),
    LogonCount=count()
    by DeviceName, LogonType
| order by FirstSeen asc

If another device appears

The incident scope changes. You now have a justified reason to continue and investigate that device because it may represent lateral movement or broader account misuse.

If no additional device appears

That does not prove lateral movement did not occur through some other mechanism, but it may be enough to keep the current incident scope focused on FIN-LT-044 unless other evidence points elsewhere.

Stage 4 — decide whether evidence is sufficient

Evidence state	Likely action	Reason
Clear legitimate explanation matches all important evidence	Close	Investigation question has been resolved.
Strong evidence of active compromise	Contain	Waiting for perfect certainty may increase harm.
Privileged account, critical asset or expanding scope	Escalate	Potential consequence exceeds routine analyst handling.
Major decision-changing question remains unanswered	Continue	The next evidence could materially change disposition or response.
Only low-value curiosity questions remain	Stop / document	Additional work is unlikely to change the operational decision.

Containment can happen before certainty

Incident response is risk management. If evidence strongly supports compromise and malicious activity may still be active, containment can be appropriate even while some investigative questions remain open.

Closure requires an explanation

“Nothing else found” is weaker than “the activity was generated by approved management software during a documented change window and no contradictory evidence was identified.”

Stage 5 — use a stopping rule

ASK: 1. Do I understand why the alert fired? 2. Do I know the affected user/device/resource? 3. Is the activity malicious, benign or still materially uncertain? 4. Do I understand current incident scope? 5. Is malicious activity still active? 6. Is there enough evidence to justify containment? 7. Does this require escalation? 8. Is there an unanswered question that could change my decision? IF YES TO #8 Continue. IF NO TO #8 Make the decision. Document the evidence. Move the incident forward.

The end of an investigation is a decision backed by evidence — not the exhaustion of every possible pivot.

Your investigation decision board

Question	Current answer	Effect
Did suspicious PowerShell execute?	Yes	Supports endpoint compromise hypothesis.
Did it communicate externally?	Yes	Strengthens concern.
Does the user recognise the activity?	No	Further supports unauthorised activity.
Is there a validated benign explanation?	No	Closure is not appropriate.
Is additional device scope identified?	No evidence yet	Current scope remains focused.
Do we have enough evidence to contain FIN-LT-044?	Yes	Move from investigation to response.

Write the stopping decision like an analyst

Example: Investigation confirmed suspicious PowerShell execution on FIN-LT-044 followed by external network communication. The associated user does not recognise the activity, and no validated administrative or software explanation has been identified. Additional review did not identify evidence of the account logging on to another endpoint during the current investigation window. Although some questions remain regarding the full attacker objective, the existing evidence is sufficient to treat FIN-LT-044 as potentially compromised and proceed with containment. Investigation can continue after immediate response actions without delaying risk reduction.

Lesson 7 key takeaways

Every investigation should be working toward an operational decision.
You do not need to explain every event before taking action.
Prioritise questions that can change disposition, scope, urgency or response.
Do not confuse analyst curiosity with incident necessity.
Strong evidence of active compromise may justify containment before perfect certainty.
Closure should be supported by a validated explanation, not simply a lack of additional findings.
Use focused KQL queries to answer high-value unresolved questions.
Stop expanding when additional pivots are unlikely to change the decision.
Document important remaining uncertainty even when you stop investigating.
The end of one investigation stage may be the beginning of containment or escalation.

Module 1 — inside the SOC

You now know when evidence is sufficient to make a decision. The next lesson focuses on recognising when that decision should be escalation.

Next: Lesson 8 — This One Needs Escalation

Continue your SOC Analyst training

Module 1 builds the analyst mindset: triage, evidence collection, entity pivots, stopping rules and defensible decisions.

SOC Analyst Academy KQL Academy Microsoft Sentinel Academy Defender for Endpoint Academy Microsoft Entra Security Academy Security Copilot Academy Agent Foskett Academy

🔎 SOC Analyst Academy — Module 1: Inside the SOC: Thinking Like an Analyst

Learn how a SOC analyst decides when enough evidence exists to close, contain, escalate or continue an investigation.

← Previous lesson

Lesson 6 — The Alert Had Five Entities — Which One Do You Pivot On? Choose the most useful user, device, IP, process, file or URL pivot for the next step.

✅ Current lesson

Lesson 7 — When Do You Stop Investigating? Decide when evidence is sufficient to close, contain, escalate or continue.

Next lesson →

Lesson 8 — This One Needs Escalation Recognise scope, impact and uncertainty that require escalation.

When should a SOC analyst stop investigating?

Lesson 7 of the Agent Foskett SOC Analyst Academy teaches analysts how to decide when evidence is sufficient to close, contain, escalate or continue a Microsoft security investigation.

Evidence thresholds, containment and SOC escalation

Learn how to identify decision-changing questions, avoid unnecessary investigation expansion and use focused KQL queries to validate incident scope before taking action.