Similar to how we handled the SOC Workbook and Lookup, what we’re doing here is triaging an alert in Microsoft Sentinel. The real question is: how should a SOC analyst actually work through an alert to make the right call? After all, it can be just noise or false positive.
SOC can use these as metric to determin if an incident is serious