Lesson 1 of 6 · 20 min read

The Four Alert Classes — Recognition and Routing

The single most valuable skill in alert triage isn’t knowing every technique — it’s knowing which drawer to open first. An analyst who can route an alert to the right playbook in 30 seconds, then execute that playbook consistently, will outperform an analyst who knows more but approaches every alert from scratch.

Alert Class Decision Tree

Read the alert.
│
├─ Primary observable is a HOST EVENT?
│   (process, file, registry, service, driver)
│   └─► ENDPOINT PLAYBOOK
│
├─ Primary observable is a NETWORK EVENT?
│   (connection, flow, IDS hit, DNS query, TLS fingerprint)
│   └─► NETWORK PLAYBOOK
│
├─ Primary observable is an AUTH/IDENTITY EVENT?
│   (login, MFA, OAuth grant, role assignment, password change)
│   └─► IDENTITY PLAYBOOK
│
└─ Primary observable is an EMAIL EVENT?
    (submission, header anomaly, link, attachment, mailbox rule)
    └─► EMAIL PLAYBOOK

Class 1: Endpoint

Data sources: EDR (CrowdStrike, SentinelOne, Defender for Endpoint), Sysmon, Windows Security EVTX, auditd (Linux), Unified Endpoint logs.

Primary question: What process did what, to what?

Core pivot chain:

  1. Process name + path + command line
  2. Parent process (what spawned this?)
  3. Child processes (what did this spawn?)
  4. Network connections from this process
  5. File writes from this process
  6. Registry modifications

Classic indicators:

Class 2: Network

Data sources: Suricata/Snort IDS, Zeek logs (conn.log, dns.log, ssl.log, http.log), NetFlow, PCAP, firewall logs.

Primary question: What connected to what, with what pattern?

Core pivot chain:

  1. Source IP → destination IP → port → protocol
  2. Zeek conn.log for session duration and byte count
  3. Zeek dns.log for associated queries
  4. Zeek ssl.log for TLS fingerprint (JA3/JA4) and certificate
  5. Payload or file extraction (if PCAP available)
  6. Frequency analysis: is there a regular interval? (beacon?)

Classic indicators:

Class 3: Identity

Data sources: Azure Entra ID sign-in logs, Okta System Log, AWS CloudTrail (AssumeRole, IAM events), Active Directory Security EVTX (4624, 4625, 4768, 4769), MFA logs.

Primary question: Did the right person authenticate from the right place with the right method?

Core pivot chain:

  1. User account → department, role, MFA enrollment, admin status
  2. Authentication location: IP geolocation, ASN, is it known VPN/proxy?
  3. Authentication method: modern vs legacy auth, MFA success/fail
  4. Prior authentication locations: is this a new country? Impossible travel?
  5. What happened after authentication: what resources were accessed?
  6. Lateral accounts: did this credential spray other accounts?

Classic indicators:

Class 4: Email

Data sources: Microsoft 365 Unified Audit Log (UAL), Google Workspace Admin Activity, email gateway (Proofpoint, Mimecast), email headers, attachment sandbox.

Primary question: Was this email sent legitimately, and what did the recipient click?

Core pivot chain:

  1. Sender: domain, DMARC/DKIM/SPF result, is it a lookalike?
  2. Received chain: what IP actually sent this? Is it expected infrastructure?
  3. Links: detonated URL — where does it go? Is it credential-harvesting?
  4. Attachments: hash → VT, macro-enabled?, sandbox report
  5. Mailbox actions: did the user click? Did a rule get created? Was mail forwarded?
  6. Reply-to: does it differ from the display sender? (BEC indicator)

Classic indicators: