Triage

No matching approval

1. Receive. Nyx starts with the received alert and its event references. Incident status, task authorization and next action are still undecided. AL110 is already in Nyx’s case view; delivery happened before this example. It cites the rule and I110/E110. The source observations describe an account’s activity, not which human performed it. Triage starts without a completed business-context check, containment action or incident decision.
2. Read facts. Nyx reads I110 and E110: the same U110 account gained an admin role at 08:00 and exported F110 at 08:04. The event references resolve to retained source copies. The read confirms the account, event types, UTC times and selected file, with a 240-second gap. It does not prove why the role was granted or who used the account. F110’s assumed Confidential staffing purpose makes misuse potentially consequential. Source accuracy and current relevance are controlled, not inferred from the alert’s severity label.
3. Check task. The authoritative register returns no matching approval. That gap warrants prompt review, but does not establish an attack. An independent read of the assumed complete task register returns no matching approved task covering U110’s admin addition at 08:00 and F110 export at 08:04. This is an evidence gap, not proof of stolen credentials or malicious intent. The confidentiality of the staffing file and recency justify prompt owner review under this fictional procedure. Register authenticity/completeness and source accuracy are assumptions; real incomplete records would need further validation.
4. Record next. Nyx saves prompt escalation to Vera Vance by 08:15, with source facts and the approval gap. Vera’s receipt and decision remain unconfirmed. T110 retains AL110, I110/E110, the task-register result, reasoning, open questions and the next action. The approved path closes only this specific alert under the exercise’s procedure; no broad safety verdict or incident closure is recorded. The gap path requests prompt incident-lead review because of the recent privileged staffing export, with an explicit owner and follow-up time. Saving the handoff does not acknowledge Vera’s receipt, declare an incident, revoke access or complete an investigation.

CH110 approved task

1. Receive. Nyx starts with the received alert and its event references. Incident status, task authorization and next action are still undecided. AL110 is already in Nyx’s case view; delivery happened before this example. It cites the rule and I110/E110. The source observations describe an account’s activity, not which human performed it. Triage starts without a completed business-context check, containment action or incident decision.
2. Read facts. Nyx reads I110 and E110: the same U110 account gained an admin role at 08:00 and exported F110 at 08:04. The event references resolve to retained source copies. The read confirms the account, event types, UTC times and selected file, with a 240-second gap. It does not prove why the role was granted or who used the account. F110’s assumed Confidential staffing purpose makes misuse potentially consequential. Source accuracy and current relevance are controlled, not inferred from the alert’s severity label.
3. Check task. CH110 approves both U110’s admin addition and F110 export during 08:00–08:10. Both observed actions match that exact task. Independent readback returns approved CH110 for U110’s admin addition and export of F110, starting 08:00 inclusive and ending 08:10 exclusive. Both the 08:00 role addition and 08:04 export fall inside that window. Approval must cover both actions: a ticket permitting only the export cannot explain the admin addition. Another account, file, time or an unapproved request also cannot match. The register is assumed authoritative and complete for the selected task; this does not independently identify the human using U110.
4. Record next. Nyx saves a reasoned closure of AL110 linked to CH110. This decision covers the selected alert; wider activity remains unreviewed. T110 retains AL110, I110/E110, the task-register result, reasoning, open questions and the next action. The approved path closes only this specific alert under the exercise’s procedure; no broad safety verdict or incident closure is recorded. The gap path requests prompt incident-lead review because of the recent privileged staffing export, with an explicit owner and follow-up time. Saving the handoff does not acknowledge Vera’s receipt, declare an incident, revoke access or complete an investigation.

T110 records a preliminary decision about AL110, not a full investigation. No approval found is not proof of an attack. A matching approved task supports closing this scoped alert, not declaring every session or system safe. Human attribution, broader activity and any incident remain separate; escalation does not grant containment authority or confirm receipt.

Flow references: NIST SP 800-61 Rev. 3: incident criteria and triage · NCSC: SOC roles, context and recorded handoffs