Changing the state to ‘Assigned’ formally acknowledges that an analyst is actively working on the incident, which is crucial for workflow management in a SOC. Adding an annotation documents the initial findings (geographic anomaly, pattern of failure then success) for other team members and for the incident timeline, ensuring knowledge transfer and audit trail.

The MITRE ATT&CK framework is structured hierarchically: Tactics answer the ‘why’ (the adversary’s objective, like Credential Access). Techniques answer the ‘how’ (the specific method to achieve that objective, like Brute Force). This distinction is critical for precise reporting and mapping defensive controls to specific adversary behaviors.

Adding the known-good entity (backup server) to an exclusion list for that specific rule is a targeted approach. It reduces noise for the SOC analysts while preserving the rule’s effectiveness for all other devices on the network. This maintains the security intent and is more sustainable than manual acknowledgment or globally changing thresholds.

Adversaries often abuse legitimate tools like `msiexec.exe` (Windows Installer) to launch malicious payloads. Using it to execute `powershell.exe` is a common technique to deploy and run PowerShell scripts silently, often as part of an exploit or initial access payload. This deviation from normal process trees (e.g., user-initiated PowerShell) is a key behavioral indicator of compromise.

The ‘Offenders’ list in FortiSIEM aggregates and ranks entities (like IPs, users, hosts) based on triggered rules and event counts. Finding the external IP in this list quickly shows you its threat ‘score,’ what other rules it may have triggered, and the volume of associated events, providing immediate context for triage prioritization.

FortiSIEM’s automatic actions on rules or incidents are designed for exactly this purpose. By configuring an action to change the owner and state, you enforce the policy directly in the tooling, creating a consistent, auditable workflow. This is more reliable than manual processes or passive notifications.

Effective correlation rules look for a sequence of related, suspicious behaviors. The core behaviors of this ransomware are mass file encryption (modification events) and then marking them (rename events to a specific extension). Combining these with an AND condition creates a much stronger, more specific signal than any single event or unrelated pair of events, reducing false positives.

Tuning is the iterative process of refining detection logic to better align with the environment. This involves making rules more precise by adjusting thresholds (e.g., more than 10 failed logins in 1 minute instead of 5), broadening/narrowing time windows, and adding exclusions for authorized systems or normal business activity. The goal is to maintain detection coverage while improving signal-to-noise ratio.

The Search/Event Viewer is the primary tool for ad-hoc forensic investigation. Filtering on the source IP (srcIp) for a recent time range (e.g., last 60 minutes) and focusing on event types like ‘Firewall Session’ or ‘Traffic’ will display a list of all connections from that host. You can then analyze destination IPs/domains and ports for patterns indicative of beaconing.

Changing the state to ‘Assigned’ formally acknowledges that an analyst is actively working on the incident, which is crucial for workflow management in a SOC. Adding an annotation documents the initial findings (geographic anomaly, pattern of failure then success) for other team members and for the incident timeline, ensuring knowledge transfer and audit trail.0