liveBook · Manning

Alerting

As explained in Cyber Threat Hunting

A security alert is a notification that recorded activity matches conditions associated with potentially suspicious or malicious behavior.

Security alerting notifies defenders when recorded activity matches conditions associated with potentially suspicious or malicious behavior. It turns telemetry into an actionable signal for triage and investigation, especially within a security operations center (SOC). section 1.4 section 10.2.5

A practical alerting workflow connects detection data to human response:

  • Deploy decoys or other detection points, then configure the data store to alert the security monitoring team when interaction occurs. section 10.2.5
  • Provide the monitoring team with basic deployment information and agree how alerts move from triage to threat-hunter investigation. section 10.2.5
  • Collect investigation-critical evidence, such as process name, initiating account, and command-line arguments from Windows process-creation events. section 10.2.5
  • Have SOC analysts triage and investigate alerts from endpoint detection and response (EDR) tools or security information and event management (SIEM) systems. section 1.4

Decoy interaction with process evidence

A decoy may sit untouched for minutes, hours, or days. When an adversary interacts with it, alert the monitoring team immediately and route the event to a threat hunter. Windows Event 4688 can add process, user-account, and command-line context to the investigation. section 10.2.5

Listing 10.3 Sample Event 4688
{
"Name":"Microsoft-Windows-Security-Auditing",                      #1
"Guid":"{54849625-5478-4994-A5BA-3E3B0328C30D}",                   #2
"EventID":"4688",                                                  #3
"Version":"2",                                                     #4
"Level":"0",                                                       #5
"Task":"13312",                                                    #6
"Opcode":"0",                                                      #7
"Keywords":"0x8020000000000000",                                   #8
"SystemTime":"2023-12-03T18:40:20.053482600Z",                     #9
"EventRecordID":"701239",                                          #10
"ProcessID":"4",                                                   #11
"ThreadID":"404",                                                  #12
"Channel":"Security",                                              #13
"Computer":"apidevdc01.example.com",                               #14
"SubjectUserSid":"NT AUTHORITY\\SYSTEM",                           #15
"SubjectUserName":"APIDEVDC01$",                                   #16
"SubjectDomainName":"EXAMPLE",                                     #17
"SubjectLogonId":"0x3e7",                                          #18
"NewProcessId":"0x13fc",                                           #19
"NewProcessName":"C:\\Windows\\System32\\MusNotification."
"exe",                                                             #20
"TokenElevationType":"%%1936",                                     #21
"ProcessId":"0x33c",                                               #22
"CommandLine":"\"C:\\Windows\\system32\\MusNotification."
"exe\" Display",                                                   #23
"TargetUserSid":"NULL SID",                                        #24
"ParentProcessName":"C:\\Windows\\System32\\svchost."
"exe",                                                             #25
"MandatoryLabel":"Mandatory Label\\System Mandatory "
"Level"                                                            #26
}

Inspect a sample Windows Event 4688 record to see the structured metadata supporting alert investigation. section 10.2.5

How Cyber Threat Hunting covers it

How deep it goes
Explains alert routing and evidence collection, then demonstrates Windows process auditing with Event 4688 and audit-policy commands.
Examples
Uses decoy interactions, SOC alert triage, Windows Event 4688 records, and process-creation audit-policy commands.
What it assumes
Assumes basic security-monitoring roles and introduces the relationship between detection alerts, SOC analysts, and threat hunters.
What you can do after
Operate/configure alerts, route them for triage, and investigate process activity using Windows Event 4688 or EDR telemetry.
How it connects
Connects security alerts with threat detection, threat hunting, SOC operations, EDR, SIEM, deception, and Windows Event 4688.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

Compare how 10 books explain alerting →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.