I got an alert, now what?

A newer analyst asked the speaker what to do when an alert fires, and the speaker set out to lay out a full triage methodology instead of a shortcut. The example is a high-severity alert saying Excel launched a suspicious program. The talk starts by working out what the alert actually reports, building a process tree, and noting file names and hashes, while warning against chasing side investigations too early.

Next comes the question of whether the activity is a threat. Hashes are checked against public lookup services, with a caution never to upload company files to a public scanner. A clean signature from a major vendor does not prove safety, because trusted built-in tools can be abused. The lookups pointed to a known malware family, and the speaker explained how to judge its likely impact, including delivery through email and a goal of stealing credentials. Containment, scoping across other endpoints, and reimaging followed.

When indicators come back inconclusive, the speaker suggests tracing where the file came from and where it went, checking whether the behavior is normal for the user, device, or environment, and asking colleagues for context. The takeaways: document normal behavior, tune detections that keep firing, and pass along the relevant artifacts rather than every data point when escalating.