Security Incidents
An alert has fired. What should be done?
Input
- The alert: what fired, on which asset, and when
- The asset: its environment, tier and owner
- Open tickets: change requests and incidents already in flight
- Registered devices: the hardware this person is known to use
- Scheduled maintenance: work someone booked in advance
- Standing authorizations: who may do what, and until when
Output
- AUTO CLOSE
- NOTIFY USER
- ESCALATE TIER 2
- KILL PROCESS
- DISABLE ACCOUNT
- ESCALATE URGENT
Lens Cost Time
Security Incidents: accuracy against cost and time
| Type | Cost per case, USD (log) | Accuracy |
|---|---|---|
| haiku 4.5 | $0.0047 | 58.8% |
| shaiku 4.5 | $0.0068 | 17.1% |
| opus 5 | $0.0574 | 66.2% |
| sopus 5 | $0.0619 | 62.9% |
| sonnet 5 | $0.0271 | 60.8% |
| sDS v4 flash | $0.0032 | 37.9% |
| sDS v4 pro | $0.0234 | 41.7% |
The workflow
Read the alert
Three questions about the alert and the records joined to it: was the activity unauthorized, does a record explain it, and how strong is the evidence?Close, queue, or act
The code combines the three answers with how important the machine is and where it runs. Borderline identity alerts also notify the user.The state of the incident
Acting opens eleven more questions: credentials, live sessions, mail, anything left behind to run later, processes, network traffic, and how far the activity spread.Choose the response
The playbook takes the first group whose conditions are met, then the strongest step in it that still applies. When no group applies, the alert is escalated.
A handful of cases:
For each model, one where it alone differs from the other two; one where all three miss the reference; one where all three agree. Each model's path is drawn on the chart in its own colour and line style. Where paths share a stretch, the lines run side by side. What no model reached is faded. Underlined questions open below with every model's answer and the state it read.
- Network sniffing while badge onsite: Opus differs from the other two
- WinRM access on production server: Sol differs from the other two
- LSASS memory dump via comsvcs: TypeSafe differs from the other two
- Amsi.dll renamed as WinAppXRT: All three miss the reference
- Python startup hook via calc.exe: All three agree
Models
| Model | Description |
|---|---|
| Opus | One alert the alert, the asset it fired on, tickets, registrations, schedules and authorizations joined to it. |
| Sol | Is this unauthorized activity? |
| TypeSafe | What state is the incident in? |
Choose the response
- Data is leaving now:
- BLOCK DESTINATION
- BLOCK EGRESS ASSET
- The attacker has access:
- DISABLE ACCOUNT
- REVOKE ACCESS KEY
- REQUIRE REAUTH
- Malicious mail is delivered:
- BLOCK SENDER
- PURGE MAILBOXES
- The host is compromised:
- ISOLATE HOST
- KILL PROCESS
- Configuration was changed:
- REMOVE FORWARDING RULES
- ESCALATE URGENT