Select Two (Multi-Select) Questions

Suppress alerts only with documented criteria and expiry

Time-bound suppression preserves governance.

Add enrichment such as asset criticality and threat-intel context

Enrichment helps analysts prioritize real risk.

Memory image or live response data

Fileless activity may exist mainly in memory.

Active network connections and running processes

Live state helps reconstruct behaviour.

Add domain age and lookalike/typosquatting checks

New and visually similar domains are common phishing indicators.

Use attachment sandboxing and URL detonation results

Dynamic analysis can reveal malicious behaviour beyond static lists.

Internet exposure of the affected asset

External reachability increases likelihood of attack.

Known exploitation in the wild

Active exploitation increases urgency.

Business criticality of the affected service

Impact depends on the service supported by the asset.

Review audit logs for actions performed with the key

Audit review establishes scope and impact.

Disable or rotate the exposed key

The credential must be invalidated to stop further use.

The asset supports a critical business process

Business impact increases priority.

The affected asset is internet-facing

External exposure increases attack opportunity.

Exploitation is observed in the wild

Active exploitation increases likelihood.

Initial infected host and user context

The starting point helps identify root cause.

Backup integrity and last known clean restore point

Recovery depends on clean backups.

Shares or systems touched by the compromised account

Access path shows spread.

Root cause and exploited control gaps

Technical teams need to know what failed.

Specific remediation tasks with owners and validation steps

Actionable tasks enable closure.

Remove the web shell and close the exploited vulnerability

Both malicious artefact and entry path must be addressed.

Rotate credentials exposed to the compromised web server

Server compromise may expose application or service credentials.

Containment actions completed and pending

Status shows risk reduction progress.

Known decisions or approvals needed

Escalation points help leadership act.

Current impact and affected services

Leadership needs business impact.

Whether sensitive objects were accessed or downloaded

Access evidence supports impact assessment.

Whether public access is effectively allowed by bucket and account policies

Effective permissions determine exposure.

The binary is normally administrative but launched from an unusual parent process

Parent context can indicate abuse of legitimate tools.

The command line performs download, encode, dump, or remote-execution behaviour

Suspicious arguments reveal malicious use of trusted tools.

Verify time synchronization and timezone parsing for each source

Clock drift and timezone conversion errors can reorder events.

Normalize events to a common timestamp standard such as UTC

A common time basis is required for reliable reconstruction.

Documented compensating controls and monitoring

Controls reduce risk while the vulnerability remains.

A time-bound owner-approved risk acceptance

Exceptions need accountability and expiry.

Authenticated access to inspect installed packages

Local package state usually requires credentials.

Scanner account permissions sufficient for inventory commands

The account must read package and configuration data.

Critical exposure trend by business service

Trends show whether risk is moving.

SLA compliance and overdue remediation by owner

This supports accountability.

SBOM generation and review for released builds

SBOMs support dependency tracking and downstream risk review.

Software composition analysis with policy gates

SCA identifies dependency CVEs before deployment.

Calculate and record hashes of acquired images

Hashes support integrity verification.

Maintain chain-of-custody documentation

Custody records show who handled evidence and when.

Pod spec fields such as privileged mode, hostPath, and hostNetwork

These fields indicate high-risk container privileges.

Recent role binding or cluster role binding changes

Privilege changes may have enabled the action.