An analyst receives an automated intrusion detection alert indicating suspicious outbound traffic from a workstation. Place the initial network security monitoring and triage steps in the correct chronological order from first to last.
- 1Validate the initial network alert to verify whether it represents a real security event or a false positive.
- 2Examine relevant packet captures and netflow logs to determine the scope and nature of the network activity.
- 3Isolate the affected workstation from the network to prevent potential lateral movement or data exfiltration.
- 4Document the monitoring findings and notify the incident response team for escalation.
Answer
The correct sequence is: First, validate the initial network alert to verify whether it represents a real event or false positive; second, examine relevant packet captures and netflow logs to determine the scope; third, isolate the affected workstation from the network; fourth, document the monitoring findings and notify the incident response team.
Effective network security monitoring follows a structured workflow: alert triage and validation must happen first, followed by telemetry inspection to scope the incident, host isolation to contain risk, and finally thorough documentation and incident escalation.
Step-by-Step Solution
Key Concept
Network Security Monitoring Triage & Incident Workflow