This chapter discusses the final alert response steps after completing the playbook and addressing all queries, including the analysis phase. Properly closing an alert is critical to determining whether the alert is true or false positive, documenting the findings, and reviewing the incident response process.
Once the playbook has been completed and all queries have been addressed, including the analysis phase, we must return to the Monitoring page within the Investigation channel to officially close the alert.
The alert needs to be analyzed to determine if it is a true positive or a false positive. A true positive means the alert is legitimate and requires further action, whereas a false positive means that the alert is a false alarm.
Once you've completed your analysis, you should document your findings in the "Analyst Note" section. This note should include the reasoning behind your decision, any relevant data or observations, and the steps taken during your investigation.
After closing the alert, you can review the details of your analysis in the "Closed Alerts" section. Here, you'll find the answers you provided to the playbook questions, confirming your accurate assessment of the situation.
You can also access the official incident report or the community walkthrough. These resources provide further insight into the investigation process and additional context around the alert, offering valuable information to understand the threat landscape and improve future response efforts. The official incident report is a comprehensive summary of the incident.
The case management feature allows you to review closed alerts. You can see the details of the alert you closed and the options you have chosen when analyzing the alert.
Note : The alert used in this arcade differs from the one used in the course because the answers in the original alert had to remain hidden.
Congratulations on completing this course!
Your role as a security analyst is vital in protecting your organization from cyber threats. By applying the knowledge and skills you've gained from this course, you'll be well-equipped to handle incidents efficiently and effectively. Keep learning, keep up with the latest trends, and always strive for excellence in your cybersecurity career.