← soc analyst
Take Quiz →
Alert Investigation Playbooks — Endpoint, Network, Identity, Email
intermediate 5h
Execute end-to-end investigations across the four highest-volume alert classes and produce written dispositions that meet L2 quality standards.
After this module you will
- › Identify the four alert classes and route any alert to the correct playbook within 30 seconds
- › Execute the endpoint playbook including process ancestry analysis and command-line decoding
- › Execute the network playbook including beacon math and Zeek log pivoting
- › Execute the identity playbook including impossible-travel and MFA abuse patterns
- › Execute the email playbook including header analysis and BEC indicator recognition
- › Write a disposition note that passes L2 quality review
Lessons
1 The Four Alert Classes — Recognition and Routing
20 min 2 Endpoint Playbook — Process Ancestry, LOLBins, and Persistence
30 min 3 Network Playbook — From IDS Alert to C2 Confirmation
25 min 4 Identity Playbook — Auth Anomalies, Impossible Travel, and MFA Abuse
25 min 5 Email Playbook — Phishing, BEC, and AiTM Triage
25 min 6 Choosing & Critiquing Playbooks — Disposition Quality and Tagging
20 min Module Quiz
Test your knowledge before moving on.