Connect the work.
Keep the evidence.

01 / EXPOSURE & VULNERABILITIES

Exposure & vulnerability priorities

Priority starts with context.

Review vulnerability and exposure information as part of a wider security picture. Make the reasoning behind a priority visible before deciding on the next action.

• Exposure and vulnerability priorities
• Relevant context for analyst review
• Clear next steps and recorded decisions

02 / INTELLIGENCE & INVESTIGATION

Threat intelligence & investigation

An investigation needs a traceable explanation.

Bring threat intelligence and case observations into the same conversation. Keep the supporting evidence accessible as the investigation develops.

• Threat intelligence in investigation context
• Connected observations and case evidence
• Analyst interpretation and decision tracking

03 / DETECTION & RULE REVIEW

Detection coverage & rule review

Understand the rule behind the signal.

Review detection coverage and rule context alongside the available observations. Capture what was reviewed and what the team decided.

• Detection coverage review
• Rule context and evaluation
• Review decisions and supporting evidence

04 / ASSETS & TELEMETRY

Asset readiness & telemetry health

Know what the SOC can see.

Asset readiness and telemetry health help analysts judge the completeness of the evidence. Make gaps visible before drawing conclusions from missing information.

• Asset readiness
• Telemetry availability and health
• Gaps that affect investigation confidence