CROWDSTRIKE FALCONSOC Analyst — Daily Shift Guide--:--:-- UTC
Shift progress
0%
1. Shift start
2. Severity sort
3. Open an alert
4. Triage
5. Respond
6. Document
MITRE ref
01
Shift start — orientation
Do this before touching a single alert. Takes ~5 min.
Log into Falcon portal
Go to falcon.crowdstrike.com → SSO or your organisation credentials. Check you're in the right Customer ID/tenant.
Go to Activity Dashboard first
Endpoint Security → Activity Dashboard (not Summary Dashboard). This gives the proper SOC view.
Check Crowd Score
Top of dashboard. Scale 0–100. Higher = more risk. Note if it has changed since your last shift.
Check Overwatch panel
Any "Hunting Leads" from Overwatch? These are expert-flagged alerts — treat as high priority even if severity looks low.
Note "Detection by Tactics" widget
Which MITRE tactics appeared today? Execution, Persistence, Lateral Movement? This tells you what type of attack is active.
Navigate to Endpoint Detections
Endpoint Security → Endpoint Detections. This is your main workbench for the shift.
Tip: Never jump straight into an individual alert. The Activity Dashboard gives you situational awareness — you need to know if there's an active incident before diving into individual alerts.
02
Sort all alerts — do NOT open randomly
You work the queue top-down by severity. Always.
Critical
Start here — always
High
Next in queue
Medium
After high done
Low
End of shift
Info
Reference only
Filter: Status = "New" only
You only want unworked alerts. In-Progress belongs to someone else. Closed is done.
Sort by Severity: Critical first
Click the Severity column header. Critical → High → Medium → Low → Informational. Never reverse this order.
Read the alert symbols — not just severity
Three symbols appear next to each alert and affect priority: Green circle with checkmark = fully blocked and resolved, lowest urgency. Orange circle with green dot = detected and process killed, may have partially executed before being stopped. Orange circle with no dot = alert only, nothing was blocked — the action may have completed. ALWAYS prioritise an orange circle with no dot over everything else, even if its severity is lower than other alerts.
Scan the list before opening anything
Same hostname appearing multiple times? Same technique? This is a pattern — could be an active breach in progress.
Assign first alert to yourself
Click Assign → select your username. Change status to "In Progress". Prevents two analysts working the same case.
Common mistake: Prioritising only by severity and ignoring the alert symbol. An orange circle with no dot on a Medium severity is more urgent than a green checkmark on a High. Always check both.
03
Read the alert — before you do anything else
Click the alert name/title to open a side panel on the right. Read it first. Then click "See Full Detection" at the bottom for the full process tree. Spend 2–3 min reading before acting.
Read: What device was hit?
Hostname and OS. Is this a SERVER (higher urgency, business impact) or a WORKSTATION (can isolate faster)?
Read: What user was logged in?
Regular user, admin account, or service account? Admin = escalate immediately. Service account = likely lateral movement.
Read: Was it BLOCKED or just ALERTED?
Green shield icon = blocked (process didn't complete). No icon = alert only — process MAY have run successfully. Treat as urgent.
Read: What MITRE tactic and technique?
CrowdStrike shows this on the alert. Note the Tactic (e.g. Execution) and Technique ID (e.g. T1059). Look it up on attack.mitre.org if unfamiliar.
Look at the Process Tree
Work BACKWARDS from the alert. What was the parent process? Outlook → PowerShell? Word → cmd? Suspicious parent = likely malicious. Read every command line argument shown.
Analyse the command line
Break down every argument in the command. Ask: what is this trying to do? Is this normal behaviour for this process? Could a legitimate user have typed this? Example: reg add + UserInitMprLogonScript + backdoor.exe = persistence attempt. Understanding the command tells you the attacker's intent.
Check for Threat Actor indicator
Small icon on alert = CrowdStrike has linked this to a known threat actor group (e.g. BEAR, SPIDER, PANDA naming). Note the group name.
Check Network Connections tab
Any active outbound connections to external IPs? If yes — the process may be calling back to a C2 server. Note the IP. This is urgent. SKIP this step if the alert involves registry-only tools like reg.exe — they do not make network connections. Network connections matter most for alerts involving PowerShell, unknown executables, or C2 activity.
Rule: Read first, act second. Many junior analysts start isolating or blocking before they understand what they're looking at. Read the full alert first — it takes 3 minutes and saves you from mistakes.
04
Triage — true positive or false positive?
Use the decision helper below, then investigate accordingly.
Device type
Workstation
Server
Unknown
Was action blocked?
Yes — green shield
No — alert only
Parent process suspicious?
Yes (Outlook→PS, Word→cmd)
No — looks normal
VirusTotal result on hash/IP?
Malicious detections
Clean / unknown
Haven't checked yet
Select options above to get a triage recommendation.
Check VirusTotal for all hashes
Copy file hash from CrowdStrike → paste at virustotal.com. Do this for every suspicious file/hash. 0 detections = unknown; 5+ = almost certainly malicious.
Check VirusTotal for suspicious IPs/domains
Any external IP or domain in Network Connections → check on VirusTotal. Also try AbuseIPDB for IP reputation.
Check Advanced Event Search for context
Investigate → Advanced Event Search. Search by hostname or username. Did this device/user trigger other alerts today? Context is everything.
Make your verdict: True or False Positive
True Positive = confirmed malicious activity. False Positive = legitimate behaviour incorrectly flagged. If unsure → escalate to senior analyst. Never guess.
Alert fatigue trap: If you see the same pattern 10 times and close them all quickly, you may miss the one that's real. The Medibank breach happened partly because real alerts were closed as false positives. Every alert deserves a real look.
05
Respond — true positive confirmed
You've confirmed it's real. Now act fast and in order.
Contact the user (workstations only)
Call or message: "Don't touch your computer or reboot. Step away." Rebooting destroys volatile memory evidence.
Contain the host
Host Details tab → Contain Host. CrowdStrike cuts all network connections but keeps the RTR tunnel open so you can still investigate remotely.
Connect via RTR (Real-Time Response)
Click "Connect to Host". You now have a remote command line on the contained machine. Do NOT physically go to the device.
Capture memory dump immediately
Run: xmemdump complete — saves to C: drive. Do this FIRST — memory is volatile and lost on reboot. Most important forensic artefact.
Run ps — list running processes
Identify any suspicious processes still running. Note PIDs. Look for: unusual names, processes in temp folders, duplicate system process names.
Run netstat — check active connections
Look for ESTABLISHED connections to external IPs. Even after containment, identify what was connecting and to where.
Run CAPE to collect forensic artefacts
Upload CAPE script via RTR → run it. Collects: event logs, prefetch, registry hives, browser history, scheduled tasks. ~1 GB output.
Notify team lead
Brief your senior analyst: what device, what was found, what you've done, what you need. Don't wait until you have all answers — notify early.
Server rule: For production servers, always assess business impact with your team lead BEFORE containing. Containment may take down critical services. The decision may not be yours alone to make.
06
Document everything — every single time
Even for false positives. Documentation is what separates good analysts from great ones.
Use UTC timestamps for everything
Hover CrowdStrike timestamps to see UTC. Write all times as: 2025-04-12 14:32:17 UTC. Never use local time in your report.
Record: host details
Hostname, OS, local IP, public IP, logged-in user, user's role/department.
Record: exact process chain
Copy the full command lines exactly as shown in CrowdStrike. Parent → child → grandchild. The exact syntax matters for legal records.
Record: MITRE tactic and technique
Write the full name and ID: e.g. "Execution — PowerShell (T1059.001)". This goes in the ticket and your report.
Record: all OSINT results
VirusTotal links and detection counts for every hash, IP, and domain you investigated. Screenshot and paste results.
Record: all actions taken
When you contained the host, connected via RTR, notified team lead, ran CAPE. Every action with exact UTC timestamps.
Write a narrative summary
3–5 sentences: how the attack started, what it tried to do, what happened (blocked? succeeded?), what you did about it.
Close the ticket correctly
Status → Closed. Tag: True Positive or False Positive. If false positive, add a note explaining why and whether an exclusion rule is needed.
False positives: Still document them fully. If you close a false positive without notes, the next analyst investigates the same pattern again. Your notes save their time.
⚑
MITRE ATT&CK — quick reference
The techniques you will see most often as a SOC analyst. Click any row to open it on attack.mitre.org.
How to use: When CrowdStrike shows a Technique ID, look it up at attack.mitre.org for full detail, sub-techniques, real examples, and mitigations.
Red team tip: Red teamers typically use T1059, T1218, and T1053 most often. Watch for PowerShell from unexpected parent processes and new scheduled tasks created at unusual times.