Walk me through how you triage a new SIEM or EDR alert.
What the interviewer wants to hear
- Understand what the rule detects and its context
- Enrich with asset, user and threat intelligence data
- Build a timeline and look for related activity
- Decide true or false positive and severity
- Escalate, contain or close with clear notes
Model answer
First I read what the rule is designed to catch and the raw event behind it, so I know what normal and abnormal look like. Then I enrich: who is the user, what is the host, is it a critical server, and do any IPs, domains or hashes appear in threat intelligence. Next I build a short timeline around the alert, checking what happened before and after, such as logons, process creation, network connections and other alerts for the same user or host. From that I decide whether it is a true positive, a benign true positive or a false positive, and rate the severity based on impact. If it is malicious I follow the playbook: contain the host or account and escalate to incident response. Either way I write clear notes, and if it is a false positive I suggest tuning.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cybersecurity Analyst questions
- You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
- What is MITRE ATT&CK and how do you use it in your work?
- You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
- Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
- How do you write an incident report that works for both technical teams and non-technical leaders?
- A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
- How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
- A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
- EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.