A structured way to investigate every alert
Built on the NIST Incident Response framework, turned into a step by step process for working CrowdStrike alerts. Every investigation on this site followed these steps.
1
Confirm the alert and sensor action
2
Pull process lineage
3
Check for lateral spread
4
Map to MITRE ATT&CK
5
Recommend containment or close out
As a new WordPress user, you should go to your dashboard to delete this page and create new pages for your content. Have fun!