As AI becomes increasingly utilized throughout the security space, it's important to consider how it should be used most effectively. We've all seen companies adding AI into every offering and function they perform, often as much as possible.

In security operations, this creates a divide between two types of companies:

1. Companies that rely primarily on AI to do the work
2. Companies that enable their operators to become higher performers through the use of AI

Both types address a clear problem: volume. Anyone who has worked in a SOC knows that alert volume results in burnout, limits the number of customers you can support, and takes time away from more important tasks. Using AI to accelerate triage of high-volume, lower-complexity alerts is a practical and effective strategy. It frees analysts to focus on the ambiguous cases that require human judgment. With the right context and data, AI can meaningfully assist in distinguishing malicious from benign activity — but "most of the time" isn't good enough when a miss means a breach. AI augments the analyst; it doesn't replace their judgment.

That said, keeping a human in the loop is critical for the fringe cases: AI hallucination, highly complex technical investigations, and even situations where attackers attempt to fool the models with injection or evasion techniques.

Let's talk about some ways you can be the second type of company: the one that enables operators rather than replaces them.

AI for Triage Enhancement

Utilizing AI for enhancement of the triage process is something all security operation centers should be doing right now. While AI may occasionally be wrong or may hallucinate, anyone not taking advantage of it to work across the huge amount of data that SOCs process will fall behind their competitors.

I'm not suggesting that an AI model should be constantly closing alerts. Instead, consider this: Could an AI elevate alerts that would otherwise not have been investigated?

All SOCs process swathes of low-fidelity or low-severity alerts that are usually suppressed, deduplicated, or closed out through automation. What if you could use an AI model to review these alerts that would've been closed anyway and elevate those requiring human response to higher priorities? The worst-case scenario—a false negative—isn't applicable here. These alerts wouldn't have received much attention anyway. In the ideal scenario, you could intelligently review alerts your analysts wouldn't have looked at otherwise, escalating truly concerning activity for a human to look at.

AI for Quality Assurance

Another clear use case for AI in SOCs is quality assurance. Many QA checks on investigations are random, but what if you could curate a set of prompts that tasks AI with looking for common mistakes within your investigations and notifies a human to review them?

The AI could highlight the causes for concern, providing a starting point for the human analyst. It could even offer suggestions to both the reviewer and the analyst, making note of possible improvements. The higher quality the QA prompts, the better the feedback.

AI for Validation

Similar to the first use case mentioned, AI could validate analyst investigations and look for logical gaps or potential blind spots. Effectively, it could be used to provide top cover for analysts, giving them more space to triage quicker without chasing down every lead, knowing that the model (ideally trained on past cases!) is fact-checking and logically validating their investigation, freeing them to confidently triage without second-guessing themselves.

Human Augmentation

While AI excels at handling repetitive high-volume tasks, human expertise remains essential for complex investigations, fringe cases, and maintaining accountability. Rather than viewing AI as a cost-cutting tool to reduce headcount (or to take on many more customers with the same headcount), think of it as an investment that multiplies the effectiveness of your existing team. By strategically deploying AI to handle or fact-check routine work, you free your analysts to focus on the sophisticated threats that truly require human judgment and critical thinking.

If you take one thing from this article, I want it to be this:

Using AI to augment your operators may not show the same immediate "return" as replacing them, but, over time, it will increase your service quality tenfold.

Imagine you are a soldier on the front lines, moving through hostile terrain with only your training, tools, and instincts. That's what threat hunting in cybersecurity feels like. You're not waiting in a bunker for alarms to sound; you leave the wire, patrol the area of operations, and look for signs of the enemy before they strike.

A traditional SOC analyst is a watchtower guard: when an alarm goes off, you investigate, confirm, and respond. A threat hunter is the scout team. Your mission begins when everything appears quiet. You assume the adversary is already inside the wire, moving carefully to avoid detection, and your job is to search the terrain, uncover indicators of intrusion, and expose what automated systems miss.

The Ten Battlefield Principles of Threat Hunting

1. If you were the enemy, where would you hide? Every hunt begins by adopting the minset of the adversary—considering their objectives, prioritized systems, likely blind spots, and possible routes for remaining unseen.

2. Your job is tracking. Threat hunters scrutinize logs, processes, authentication paths, and network flows like scouts reading disturbed ground or broken vegetation. You're searching for what's out of place or subtly altered.

3. You create a hypothesis. A hypothesis defines what you expect to see if an adversary is present, giving the hunt direction and preventing aimless data trawling.

4. You move through the environment tactically. You progress methodically through hosts, logs, and authentication records, validating your hypothesis step by step, and carefully documenting your findings.

5. Intelligence guides the hunt. Threat intelligence, prior incidents, and known TTPs (tactic, techniques, and procedures) shape your approach, just as scouts rely on maps, reconnaissance, and mission briefs.

6. Your tools are your weapon systems. SIEM queries, EDR telemetry, packet captures, forensic utilities, and scripting tools are your rifles, optics, and radios. Mastery of them determines how effectively you can uncover hidden activity.

7. You respect the enemy. Adversaries are adaptive and quiet, hiding in normal traffic and shifting tactics quickly. Respect for their capability keeps you vigilant and prevents complacency.

8. When you find something, you call it in. Threat hunters identify, analyze, and escalate findings. Once hostile activity is uncovered, incident response then takes over, just as scouts report contact so their unit can quickly act.

9. The battlefield changes, and you must adapt. Technology shifts, environments evolve, and infrastructures change. Adversaries adjust accordingly, and so must you, by continuously refining techniques, revising hypotheses, and ever tuning your approach.

10. Above all, threat hunting demands a warrior mindset. Patience, curiosity, discipline, and resilience are essential. You operate in uncertainty, seek the subtle, and work where visibility is low and risk is high.

Threat hunting is not a passive role. It requires intent, stealth, and a willingness to move beyond alerts into uncertainty. By taking on the mindset of the adversary, reading the terrain, and acting with discipline, threat hunters find what the automated systems cannot.

The Pyramid of Pain: Knowing and Exploiting Your Adversary's Weak Points

The Pyramid of Pain analogy shows the hierarchy of difficulty an attacker faces when changing certain indicators and how forcing them to do so is likely to disrupt their operations.

Hash Values These are the most easily modified indicators for an adversary. A file hash changes in seconds. Hunting for hashes is like searching for footprints in loose sand.

IP Addresses Attackers replace IPs frequently because they're disposable and easily rotated. Burning an IP, in practice, disrupts nothing beyond temporary infrastructure.

Domain Names Domains require more effort to rebuild, but adversaries often maintain many of them. Forcing a domain change creates friction but doesn't significantly impair strategy.

Network and Host Artifacts These unusual processes, persistence mechanisms, registry changes, and lateral movement patterns reveal the enemy's hands-on work. Replacing them requires careful planning and technical effort, creating real operational pressure.

Tools Adversary tools like Cobalt Strike, Sliver, Impacket, and custom malware represent major investment. Exposing or disrupting them forces adversaries to retool, redesign workflows, and rebuild capabilities.

Tactics, Techniques, and Procedures TTPs are the enemy's doctrine and operational style. Disrupting TTPs applies serious pressure on them to rethink strategy, retrain operators, and redesign campaigns.

While this battlefield may be digital, the mission is the same: detect the enemy early, deny them freedom of movement, communicate new intelligence, and protect what matters before the first alarm ever sounds.

You've just confirmed it: that alert isn't a false positive. Your heart rate kicks up a notch—this is the real deal. Whether it's suspicious PowerShell execution, unusual network traffic, or signs of credential compromise, you've got a genuine security incident on your hands. Let's go.

What happens in the next 60 minutes can make or break your entire incident response. Miss a critical step, fail to preserve evidence, or escalate to the wrong people, and you could turn a manageable incident into a career-defining disaster. Tread carefully.

The First 15 Minutes: Immediate Actions

When you confirm a true positive, your brain wants to jump straight into investigation mode. Resist that urge. Instead, take the following actions right away to lay the foundation for everything that follows.

Preserve Evidence First

Before you click a button or run another query —

Document the current state:

• Screenshot the original alert with full context visible.
• Capture system timestamps (note any time zone differences).
• Record which detection rule or signature triggered.
• Note your analysis tools and queries used for confirmation.

Preserve volatile data:

• If dealing with endpoint alerts, consider memory capture before the system state changes.
• Document running processes, network connections, and logged-on users.
• Save original log entries before anyone accidentally overwrites any evidence while "investigating."

Establish Incident Tracking

Without delay, create your incident ticket with these critical fields:

• Incident ID: Use your organization's numbering scheme.
• Initial Classification: Malware, data breach, unauthorized access, etc.
• Affected Assets: Systems, IP addresses, user accounts.
• Discovery Time: When the alert fired vs. when you confirmed it was legitimate.
• Analyst: The person taking point on this incident.

Pro Tip: Many teams skip this step thinking they'll "create the ticket later." Don't. You need that incident number for all subsequent communications and actions

Quick Impact Assessment

Spend 5 minutes answering these questions to determine everything else, including your escalation path, response urgency, and resource allocation:

• Is this affecting critical business systems?
• Could this be active lateral movement?
• Is sensitive data potentially at risk?
• Are customers or operations impacted right now?

The Next 45 Minutes: Assessment and Documentation

Now you can dig deeper, but you need to do it systematically. Your goal is to build a complete picture while documenting everything for the team members who'll join your response.

Comprehensive Alert Analysis

Expand your investigation scope:

• Look for related alerts in the same time window (±2 hours).
• Check for indicators across multiple data sources (SIEM, EDR, network monitors).
• Identify the attack timeline: initial access → persistence → lateral movement → impact.

Document key findings:

• Initial Vector: How did this start (phishing, exploit, credential compromise)?
• Affected Systems: Complete inventory with hostnames, IPs, and roles.
• User Accounts: Any compromised or suspicious account activity.
• Network Activity: Unusual connections, data transfers, or command and control.
• Potential Impact: What could an attacker do with the current level of access?

Communication and Escalation: Who Needs Immediate Notifications?

(i.e., within the first 15 minutes)

Always notify the following:

• Direct supervisor/on-call manager.
• Other SOC analysts.
• Network operations (if needed).

Escalate to Security Leadership if:

• Multiple systems compromised.
• Critical business systems affected.
• Ongoing data exfiltration.
• Privileged account compromise.
• Indicators suggest APT.

Escalate to Executive Leadership if:

• Customer data confirmed compromised.
• Business operations significantly impacted.
• Potential regulatory violations.
• Media attention or disclosure is likely.

Involve Legal/Compliance if:

• PII/PHI compromised.
• Breach notification requirements.
• Law enforcement involvement.
• Regulatory reporting deadlines.

Execution and Ongoing Management

Investigation Coordination

Daily standup structure:

• Previous 24 hours: What was discovered or completed?
• Next 24 hours: What are the priority investigation activities?
• Blockers: What's preventing progress or needs leadership support?
• Key findings: Any new IOCs, affected systems, or impact discoveries?

Evidence management:

• Maintain chain of custody for all forensic evidence.
• Use standardized file naming conventions.
• Store evidence in secure, access-controlled locations.
• Document who accessed what evidence and when.

Recovery Planning in Parallel with Investigation

• System restoration: Clean rebuilds vs. remediation approaches.
• Access restoration: New credentials, certificates, and authentication tokens.
• Business process restoration: How to resume normal operations safely.
• Monitoring enhancement: Additional detection capabilities to prevent recurrence.

Leadership and Stakeholder Updates

• Security leadership: Daily — focusing on scope, impact, and containment effectiveness.
• Executive leadership: When status changes significantly or every 24–48 hours.
• Business units: When their operations or data might be affected.
• Legal/compliance: Regularly — on potential regulatory implications.

Leadership and Execution Resource Requirements

• Dedicated incident response platform: Don't rely on email chains and spreadsheets.
• Forensic tool access: Memory capture, disk imaging, and network analysis capabilities.
• Communication tools: Secure channels for sensitive incident coordination.
• Documentation templates: Standardized formats for consistent incident reporting.

Team Training Priorities

• Incident classification: How to quickly assess severity and impact.
• Evidence preservation: Proper forensic procedures that hold up under scrutiny.
• Communication protocols: Who to notify, when, and how.
• Tool proficiency: Regular hands-on training with investigation tools like DeepBlueCLI.

Final Thoughts

The moment you confirm a true positive, you're not just investigating an incident—you're protecting your organization's future. The actions you take in that critical first hour determine whether this becomes a contained incident or a business-threatening breach.

Key Principles to Remember

• Preserve first, investigate second: You can't go back and collect evidence you've overwritten.
• Communicate early and often: Stakeholders need information to make good decisions.
• Document everything: Your future self (and legal team) will thank you.
• Contain quickly, but thoughtfully: Rushed containment can destroy evidence or cause business disruption.
• Measure success by these four things: Time to containment, communication effectiveness, evidence quality, and learning integration.

Your organization is counting on you to get this right. With a reliable process, tools like DeepBlueCLI, and a systematic approach, you'll be ready when that next alert turns out to be the real deal.

Next Steps

1. Review your current true positive workflow: Do analysts know exactly what to do in the first 15 minutes?
2. Test your escalation procedures: When was the last time you exercised your communication plans?
3. Audit your investigation tools: Do you have the capability to investigate modern threats effectively?
4. Train on DeepBlueCLI: If you're not using this for Windows event analysis, start now.

Essential Reading for Report Writing

• NIST SP 800-61: Computer Security Incident Handling Guide (Section 3.4 on documentation).
• CERT Resilience Engineering Framework: Structured approaches to incident documentation.
• Your organization's legal requirements: Know what documentation standards apply to your industry.

Tool Resources

PowerShell for Security Professionals: Advanced techniques for incident response.

Windows Event Log Analysis: Understanding what logs contain the evidence you need.

Working in the SOC can be a grind. Whether triaging alerts, escalating to clients, or just trying to understand why users download malicious files, we feel the need to get through tickets as fast as possible. But in that rush, we can actually hinder our progress and slow ourselves down.

What can we do to make tickets, notes, and escalations aid the SOC in the past, present, and future? Using structure, “building upon,” and clear and concise direction, we can set ourselves and the SOC up for success.

Structure

In one of Jason Blanchard’s “Job Hunt Like a Hacker” BHIS livestreams, he emphasized using bullet points when listing job experience rather than a big wall of text, as “people will get lost and stop reading.” I took this advice to heart in the way I structure the internal notes of my tickets.

I use structured, cascading bullet points to document each step taken and each piece of evidence discovered during triage. This format makes it easy for any teammate to pick up where I left off — or for a lead to QA my work without asking me to explain it.

Building Upon

Now that we know how to structure our notes, what should we actually document? While triaging the alert, begin with steps taken. This could be “- Ran query: {the query itself or link to SIEM platform of query used}”, “- Investigated User’s recent login history”, etc. From there, gather evidence (log data, artifacts, screenshots, etc.) pertaining to the events that occurred and add them to your notes as you discover them.

Just because you add something to your notes, doesn’t mean it’s set in silicon (excuse my play on words...). If an event or evidence is not actually linked to the alert, you can remove it. It’s better to capture too much and trim later than to miss something you’ll need to reconstruct hours or days from now. This is a key part of the “Report-As-You-Go” process.

Clear and Concise Direction

We have our structure and our evidence... now what? It’s time to edit down and proofread what we have in the internal so that it only contains necessary information. Clear away any rabbit holes or evidence not pertinent to the alert in question. Your thought process should be apparent from the information you present. A final bullet point stating your verdict will enhance this clarity, such as “- Atypical behavior of user, will escalate and confirm expected.”

With the evidence well-documented and your verdict made, you are set to either update the client or close the ticket, setting everyone up for future success.

Documentation Muscle

Just like regular muscles, you need to constantly work out your reporting-as-you-go muscles. The more you exercise these muscles, the stronger they become. It’s an ever-improving process: the first couple of internals you create are not going to be great, but you will see improvement the more you work at it. Another way to work this muscle is to start a blog and write walkthroughs on different cyber rooms, CTFs, or topics you’re studying. Get started today!

Resources

How To Write Practical Lab Notes with Obsidian and Notion with Daniel Lowrie and Antisyphon Training

The Formula for Great SOC Tickets by Hayden Covington

by Dan “Haircutfish” Rearden | haircutfish.com | Guest Author Working in the SOC can be a grind. Whether triaging alerts, escalating to clients, or just trying to understand why users […]

The post Report As You Go: Maintaining Good Documentation for SOC Analysts appeared first on Black Hills Information Security, Inc..

Security Operations Centers (SOCs) serve as a critical line of defense against today's constantly evolving cybersecurity threats. At the heart of these teams are SOC analysts, who monitor, detect, and respond around the clock to potential attacks.

The post The Life of a SOC Analyst: Responsibilities, Challenges, and Strategies for Success appeared first on Black Hills Information Security, Inc..

Spend time performing forensic analysis on the Windows Operating System and you'll see a host of artifacts that can be used to identify adversary activity. From changes to the registry to the System Resource Utilization Monitor, Windows artifacts run deep. The challenge is locating, extracting, and parsing these artifacts in an efficient manner.

The post KAPE 101: A Kroll Artifact Parser and Extractor Cheatsheet appeared first on Black Hills Information Security, Inc..

We're all petrified about missing a critical event or misclassifying an alert, but when we're talking about incident response (IR), there are often hundreds if not thousands of alerts to parse through. It's easy to get caught up with one alert because it feels "too hot" or maybe not spend enough time looking into something that initially seems "too cold."

The post Finding the “Goldilocks” Zone: A Practical Approach to Alert Triage appeared first on Black Hills Information Security, Inc..

This overview of the basics of Cloud Security includes some tips and resources for getting started in defending the cloud.

The post Cloud Security: Tips and Resources for Securing the Cloud appeared first on Black Hills Information Security, Inc..

Learn how to transform boring, meeting-style security tabletop exercises into engaging real-world scenario simulations.

The post How to Lead Effective Tabletops appeared first on Black Hills Information Security, Inc..

“GRC” isn’t all witchcraft and administrative nonsense — it’s the core that drives security initiatives, connects security spend to business outcomes, and powers a well-functioning security team.

The post Understanding GRC: How to Navigate Risks and Compliance Standards appeared first on Black Hills Information Security, Inc..

Malware analysis is an amazing field that can be interesting, fun, and useful for your cybersecurity career. If you’re wondering WHY anyone would want to dig into malware, it’s all for a better understanding of cybersecurity!

The post Malware Analysis: How to Analyze and Understand Malware appeared first on Black Hills Information Security, Inc..

OSINT stands for open-source intelligence, and it refers to all publicly available information on the open internet which has been obtained without any special requirements (paywalls, invitations, etc.).

The post OSINT: How to Find, Use, and Control Open-Source Intelligence appeared first on Black Hills Information Security, Inc..

Having assembled fundamental lab components, you now get to play! However, the ocean of potential projects can be intimidating. Where does one even start?

The post What to Do with Your First Home Lab appeared first on Black Hills Information Security, Inc..

In today’s interconnected digital world, information security has become a critical concern for individuals, businesses, and governments alike. Cyber threats, which encompass a wide range of malicious activities targeting information systems, pose significant risks to the confidentiality, integrity, and availability of data.

The post Common Cyber Threats appeared first on Black Hills Information Security, Inc..

Setting goals is a deceptively simple career skill we all know is important, but how do you set goals you’re actually excited to work towards?

The post How to Set Smart Goals (That Actually Work For You) appeared first on Black Hills Information Security, Inc..

An Infosec Survival Guide Resource, released as blog posts, with fully designed, printer-friendly PDF cheatsheets.

The post Offensive Tooling Cheatsheets: An Infosec Survival Guide Resource appeared first on Black Hills Information Security, Inc..

DNS Triage is a reconnaissance tool that finds information about an organization's infrastructure, software, and third-party services as fast as possible. The goal of DNS Triage is not to exhaustively find every technology asset that exists on the internet. The goal is to find the most commonly abused items of interest for real attackers.

The post DNS Triage Cheatsheet appeared first on Black Hills Information Security, Inc..

GraphRunner is a collection of post-exploitation PowerShell modules for interacting with the Microsoft Graph API. It provides modules for enumeration, exfiltration, persistence, and more!

The post GraphRunner Cheatsheet appeared first on Black Hills Information Security, Inc..

Burp Suite is an intercepting HTTP proxy that can also scan a web-based service for vulnerabilities. A tool like this is indispensable for testing web applications. Burp Suite is written in Java and comes bundled with a JVM, so it works on any operating system you're likely to use.

The post Burp Suite Cheatsheet appeared first on Black Hills Information Security, Inc..