Alerts and response
What to do when an alert arrives
A critical alert is on screen and you are the only person available. The order to do things in, the things that destroy evidence, and when to call for help.
For whoever runs IT9 min readUpdated
Knowledge base
Alerts and response
What an alert means, what to do first when you have no security team, and why some detections stay quiet.
9 articles
Articles in Alerts and response
Alerts and response
Alert severity, and what a match actually means
Severity is a number about consequence, not confidence. How a rule match becomes an alert, what the four evaluation stages do, and how to triage without training.
For whoever runs IT10 min readUpdatedAlerts and response
Alert states, and who owns one
The states an alert can be in, why the logs and endpoint modules use different words, how ownership is recorded, and why closing one does not clear the risk.
For whoever runs IT9 min readUpdatedAlerts and response
The three triage queues, and which two work
Alerts, Notable events and Risk incidents look like three views of the same thing. Two of them are real work queues; the Notable events feed is empty and will stay empty.
For whoever runs IT10 min readUpdatedAlerts and response
Shadow detections, and why some rules stay quiet
Ten of the hundred shipped rules never raise an alert. What shadow mode is, why a quiet rule is not a broken one, and how those findings still reach you.
For whoever runs IT8 min readUpdatedAlerts and response
When to bring in a human
Roughly half of first-line security work automates and roughly 40% does not. The signals that mean stop and telephone somebody, and where to buy that person.
For the business owner10 min readUpdatedAlerts and response
"Contain this person": containment plans
One approval that ends sessions, isolates devices and suspends accounts across Qorionix and Microsoft 365, previewed first, undoable where possible.
For whoever runs IT9 min readUpdatedAlerts and response
"I think I clicked something": the employee report button
How staff report a suspicious click in ten seconds, what Sentinel-Q checks, what the owner's report card recommends, and how to hide the button.
For the business owner9 min readUpdatedAlerts and response
The "Something's wrong" panic button
A guided response for a suspected breach: preserve evidence into a hashed, read-only bundle, contain the threat with preview and undo, and start the NIS2 clock.
For whoever runs IT8 min readUpdated