01WHAT HAPPENSWhat is happening, and why
STAGE 01 · TRIAGEAlert intakePowerShell download methodology
WHAT'S HAPPENINGA medium-severity PowerShell methodology alert arrives from the customer SIEM. begins by asking what the alert actually means in this environment.
STAGE OBJECTIVEWhat happened, and is this signal meaningful?
ATTACK SEQUENCE⌄
- 01
Receive the signalRead the alert, severity, host and initial process information from the approved SIEM source.
- 02
Avoid a premature verdictA methodology alert is neither good nor bad on its own; requires business and technical context.
- 03
Open the evidence trailRecord the question, source and first observation so the later verdict can be audited.
02DETAILED ACTIVITYThe live signal and current environment activity
SIGNAL
!SIGNALSIGNAL
The SIEM records a suspicious download-and-execute pattern on SALES-LT-247.
03TRELLIX PLATFORMPrevention, coverage and outcome
OUTCOMESignal needs context
WHAT TRELLIX COULD DO TO PREVENT ITNative alert evidence: Provides the source event and retained telemetry reference. · Automated alert triage: Frames the initial questions and assembles the investigation plan.⌄
04VISIBILITY & EVIDENCEWhat Trellix can prove and investigate
WHAT TRELLIX SEESThe SIEM records a suspicious download-and-execute pattern on SALES-LT-247.
INVESTIGATION CONTEXTCustomer SIEM. begins analysis. It does not declare compromise or take response action from this single signal.
WHAT TRELLIX COLLECTS01 collected⌄
ALERT
PowerShell download methodology signalInitial medium-severity SIEM alert. It is an investigation starting point, not yet a .
