defensive-fast-triage

Speed up SOC triage by applying a structured severity matrix and a first-5-minutes checklist to rapidly prioritize Defender XDR alerts. This approach scopes alerts, checks process trees, and guides containment decisions for L1/L2 analysts.

Use ready-to-run KQL examples targeting common device events to detect LSASS access and credential abuse. These queries help analysts quickly scope incidents and validate Defender alerts during the initial triage process.

Escalate a security incident to incident response teams when clear escalation triggers are met, such as AiTM sign-ins or Defender being disabled. Defined criteria ensure timely handoff from L1/L2 analysts to IR or SecOps.

The first 5 minutes of incident response triage require structured steps to scope the alert, analyze the process tree, check network connections, and verify persistence mechanisms. This rapid checklist ensures immediate containment actions.

Yes, you can use this triage checklist for shell detection from web processes. The SOP includes specific severity matrix actions and KQL examples for handling shell-from-web-process alerts within Defender and XDR environments.

Yes, this SOC triage SOP maps alerts to MITRE ATT&CK techniques. It provides reference MITRE mappings alongside the severity matrix to give L1/L2 analysts context for prioritizing and responding to XDR security alerts.