Post #3628679

Most alert triage starts at the blocklist. We think that's backwards. A blocklist miss doesn't mean benign, it means "not on a list I checked". So the faster first question is "is this known-good?" Clear the legit infra, and what's left is a smaller, higher-signal pile. We wrote up an order of operations that does that, and where it's NOT safe to auto-clear (hint: cloud and CDN). https://www.reput.io/blog/soc-alert-triage-known-good-first #blueteam #SOC #threatintel