Limits to the rabbit hole of soc investigation

Guidance appreciated to how a SoC analyst should limit how far they should go in their investigation when there's some signal or alert of suspicious activity. What is the right and balanced limit of paranoia when you see a phishing email, or a VPN brute force or some wild scan on the internet, because I can go check all sorts of tools and systems, make up some assumptions and imagine things then try to prove them wrong but i also need to balance my time and energy. submitted by /u/amaged73
[link] [comments]


http://dlvr.it/T74FmJ