Analyst Workbench

此内容尚未提供中文翻译。

The Analyst Workbench is the primary workspace for SOC analysts performing real-time triage, investigation, and response. It combines alert queues, threat intelligence enrichment, MITRE ATT&CK kill-chain visualization, response actions, and investigation tools in a single split-pane view.

Layout

The workbench uses a split-pane layout:

Pane	Content
Top (60%)	Case detail — alert/incident summary, timeline, raw events, MITRE mapping, AI analysis
Bottom (40%)	Investigation tools — threat intel, response actions, log search, evidence, notes

A queue sidebar on the left shows all open alerts/incidents awaiting triage. Click any item to load it as the active case.

Triage Workflow

Step 1: Pick a Case

Open cases appear in the left queue sorted by severity (critical first). Each item shows:

8-character case ID
Alert title (2 lines max)
Detection source and severity badge
Assignee (if taken)

Click a case to load its detail in the main pane.

Step 2: Review the Alert Summary

The top card shows:

Description — what was detected
Source IP / Destination — attacker and target
Host — affected endpoint
GeoIP — geolocation of external IPs
MITRE ATT&CK — mapped tactic and technique
Detection source — which rule or AI model triggered it

Step 3: Analyze with MITRE Kill-Chain

The kill-chain strip displays all 14 MITRE ATT&CK tactics as pills:

Recon → Resource Dev → Initial Access → Execution → Persistence → Priv Esc →
Defense Evasion → Credential Access → Discovery → Lateral Movement →
Collection → C&C → Exfiltration → Impact

Active tactics for the current case are highlighted. This shows where the attacker is in the kill-chain and what to expect next.

Step 4: Enrich with Threat Intelligence

The Threat Intel tab auto-enriches IOCs extracted from the alert:

IP addresses are looked up against threat feeds (AbuseIPDB, VirusTotal)
Domains are checked for reputation and known malware associations
File hashes are scanned against malware databases

Results show risk scores, abuse confidence, country of origin, and ISP information.

Step 5: Decide and Act

Based on your analysis, choose a verdict:

Action	Keyboard	Description
True Positive	`1`	Confirmed threat — triggers response workflow
False Positive	`2`	Benign activity — closes with FP classification
Escalate	`3`	Needs senior analyst review — creates incident

Response Actions

When a threat is confirmed, take containment actions directly from the workbench:

Action	Description	Requires
Isolate Host	Network-isolate a compromised endpoint	NDR
Block IP	Block a malicious IP at the perimeter	NDR
Disable Account	Disable a compromised user account	—
Kill Process	Terminate a malicious process on an endpoint	EDR
Scan Endpoint	Trigger an on-demand endpoint scan	EDR
Collect Forensics	Collect forensic artifacts from an endpoint	EDR

Each action has a searchable input field. Type to search for the target (IP, hostname, username, process name) and select from suggestions.

Actions marked EDR or NDR require the corresponding license.

Investigation Tools

Log Search

Search logs directly from the workbench without leaving the page:

IOC chips — click extracted IOCs (IPs, domains, hashes) to instantly search logs
Full text search — type any query to search across all log sources
Results show in-context with the investigation

Evidence Collection

Attach evidence to the current case:

Capture screenshots, log excerpts, or configuration snapshots
Evidence is linked to the alert/incident for audit trail
Available for both alerts and incidents

Investigation Notes

Pre-built templates for common investigation scenarios:

Template	Use Case
Triage	Initial alert assessment and priority classification
Lateral Movement	Tracking attacker movement between hosts
Credential Abuse	Investigating compromised accounts and tokens
Malware	Analyzing malware artifacts and indicators
Data Exfiltration	Identifying data theft and unauthorized transfers

Select a template to pre-populate the notes section with structured investigation fields.

Raw Event Viewer

Expand the Raw Event section to see the full JSON payload of the triggering event. Useful for:

Verifying exact field values
Identifying additional IOCs not shown in the summary
Copying event data for external analysis

Keyboard Shortcuts

The workbench supports keyboard-driven workflows for fast triage:

Key	Action
`j`	Next case in queue
`k`	Previous case in queue
`1`	Verdict: True Positive
`2`	Verdict: False Positive
`3`	Verdict: Escalate
`Space`	Select/deselect for bulk triage
`a`	Open AI analysis
`l`	Focus log search

Bulk Triage

For high-volume alert queues, use bulk triage to process multiple alerts at once:

Press Space or click the checkbox on each alert you want to process
A bulk action bar appears at the bottom showing the count
Click True Positive or False Positive to apply the verdict to all selected alerts

This is useful during shift handoff or after a rule tuning session generates many similar alerts.

Analyst Metrics

A metrics strip at the top of the queue shows real-time SOC performance:

Metric	Description
Today’s Triaged	Number of alerts triaged in the current shift
MTTD	Mean Time to Detect — average time from event to alert
FP Rate	False positive rate for the current period
Open Critical	Number of unresolved critical alerts

Case Lifecycle

Take Ownership

Click Take Ownership to assign the case to yourself. This:

Sets you as the assigned analyst
Starts the SLA response timer
Shows your name on the queue item

Escalation

Click Escalate to:

Create an incident from an alert (if not already an incident)
Assign to a senior analyst or incident commander
Preserve all investigation notes and evidence

Close Case

Click Close Case to resolve with:

Resolution summary (required)
Classification (True Positive, False Positive, Benign)
Lessons learned (optional)

Common Investigation Scenarios

Scenario 1: Brute Force Attack

Alert appears: Multiple Failed Login Attempts from 203.0.113.45
Review summary — 50+ failed logins against admin account in 5 minutes
Check MITRE — tactic: Credential Access, technique: T1110 Brute Force
Enrich IP — threat intel shows IP from known attack infrastructure (abuse score: 95%)
Search logs — click the IP chip → see all access attempts, check if any succeeded
Respond — Block IP at perimeter, disable the targeted account temporarily
Verdict — True Positive, close with note: “Blocked source IP, rotated admin credentials”

Scenario 2: Suspicious Outbound Connection

Alert appears: Unusual Outbound Traffic to Known C2 Domain
Review summary — internal host connecting to evil-c2.example.com on port 443
Check MITRE — tactic: Command and Control, technique: T1071 Application Layer Protocol
Enrich domain — VirusTotal flags domain with 12/90 detections
Search logs — find the process that initiated the connection, check for persistence mechanisms
Respond — Isolate host, block domain at DNS, collect forensics from endpoint
Escalate — create incident for full investigation of potential compromise

Scenario 3: Lateral Movement Detection

Alert appears: SMB/RDP Activity Between Internal Hosts
Review summary — workstation connecting to file server via SMB with admin credentials
Check MITRE — tactic: Lateral Movement, technique: T1021 Remote Services
Review timeline — check if there was a prior initial access alert for this host
Search logs — look for authentication events, check if the admin account was compromised
Respond — disable the admin account, isolate both hosts
Use template — select “Lateral Movement” investigation template to document the attack path

Best Practices

Triage by severity — always start with critical alerts, work down to low
Use keyboard shortcuts — j/k navigation + 1/2/3 verdicts dramatically speed up triage
Enrich before deciding — always check threat intel before closing as false positive
Document everything — use investigation notes templates, attach evidence
Bulk triage similar alerts — when a noisy rule fires, select all similar alerts and batch-process
Check the kill-chain — if you see Initial Access, look for follow-up tactics like Execution or Persistence
Escalate when unsure — it’s better to escalate a false alarm than miss a real threat

Access Requirements

The Analyst Workbench requires the Respond (MDR) tier or above.