← Security Alert Triage: Evidence, Scope, and Handoff
1. Turn the Alert into a Testable Claim
An Alert Is a Claim, Not an Incident Verify Telemetry Before You Trust Presence or Absence
2. Scope and Test Explanations
Scope Entities and Time with Stop Rules Test Competing Hypotheses and Counter-Evidence
3. Decide, Hand Off, and Improve
Set Disposition, Severity, and Containment Authority Write the Handoff and Close the Feedback Loop
2. Scope and Test Explanations

Test Competing Hypotheses and Counter-Evidence

Compare malicious, expected, policy, and telemetry explanations through predictions rather than collecting only evidence that supports the alert.

In this lesson, you will learn to:

  • Write two or more plausible explanations with predicted evidence.
  • Seek counter-evidence and update confidence without averaging incompatible signals.

Test Competing Hypotheses and Counter-Evidence

Introduces lightweight hypothesis testing, evidence matrices, disconfirming searches, confidence calibration, and explicit residual uncertainty.

Turn explanations into different predictions

Write at least two plausible explanations that fit the alert. For an unusual administrator sign-in, examples might be approved emergency maintenance, stolen credentials, a scanner or test, and identity or geolocation enrichment error. Each explanation must predict different evidence: change ticket and management process; new device and follow-on access; test owner and bounded targets; or raw address and corrected location. If two labels predict the same observations, they are not useful alternatives yet.

Create a small matrix with evidence rows and hypothesis columns. Mark whether each item is expected, inconsistent, neutral, or unavailable. Weight evidence by reliability and diagnostic value rather than count. A raw authentication result can outweigh several reputation enrichments. Independence matters: three detections derived from the same event are not three independent confirmations. Preserve chronology because evidence after containment may reflect defender action, and evidence produced by an automated scanner can resemble user behavior.

Competing hypotheses branch into different predictionsExpected change, credential misuse, authorized testing, and telemetry error require distinct confirming and disconfirming evidence.FIELD GUIDECompeting hypotheses branch into different predictionsWhat explains thealert?Expected changeCredential misuseAuthorized testingTelemetry errorCHECKPOINTS1What explainsthe alert?2Expected change3CredentialmisuseHYPOTHESIS TREE
Competing hypotheses branch into different predictions — Expected change, credential misuse, authorized testing, and telemetry error require distinct confirming and disconfirming evidence.

Actively seek evidence that could change the leading judgment

Search deliberately for disconfirming evidence. If credential misuse leads, look for the user’s normal managed device, approved travel, a matching change, expected authentication method, and absence of predicted follow-on activity in healthy telemetry. If benign administration leads, look for unapproved targets, unusual tools, persistence, data access, or attempts outside the maintenance window. Contact an owner with a precise question and independent contact path; do not ask a suspected compromised channel simply to confirm itself.

Update confidence when evidence changes, and state why. Confidence is not the same as product severity or probability calculated by a formal model. Use the organization’s defined language and attach the strongest support, strongest contrary evidence, and remaining critical gap. Time pressure may require action before certainty. In that case, record the decision threshold, reversible containment option, and what new evidence will trigger escalation or rollback. A good analyst can explain both why the leading hypothesis wins and what would make it lose.

Confidence balances support and counter-evidenceSource reliability, diagnostic value, independence, contrary findings, and unavailable critical data shape the judgment.FIELD GUIDEConfidence balances support and counter-evidenceDECISION CUESupportingevidenceCounter-evidence andgapsSupporting evidenceCounter-evidenceand gapsReliabilityandindependenceCONFIDENCE BALANCE
Confidence balances support and counter-evidence — Source reliability, diagnostic value, independence, contrary findings, and unavailable critical data shape the judgment.

Resources

← Previous: Scope Entities and Time with Stop Rules Next: Set Disposition, Severity, and Containment Authority →