1
Incident Detection And Triage
medium
A SOC analyst is triaging a SIEM alert for a possible insider threat. The alert indicates that a user accessed a file share containing sensitive financial data outside of normal business hours. The analyst needs to gather additional context to determine if this is malicious. Which TWO of the following actions should the analyst perform to enrich the alert? (Choose two.)
Select 2 answers