1.1 | SOC Tier 1 | Alert Triage | (Elastic Defend EDR)

Lesson Description

The first step of the chase: triage in Elastic. What triage really means in a SOC, the role of the Tier 1 analyst, how to spot, validate and decide on an alert, and the alert that started the hunt for Rider.exe. Resources: The SOC Analyst Method (cybernoweducation.medium.com/what-is-the-soc-analyst-method-e1ab043d96d3) · EDR Telemetry Project (edr-telemetry.com) · Elastic Defend and ECS documentation (elastic.co/docs)

Enroll in Chasing Rider to unlock the full curriculum.