PSOE — Frequently Asked Questions

A network block list on egress only stops internet traffic; it does not prevent the host from scanning or moving laterally inside the network, nor does it stop malicious local file changes.

Rebooting erases volatile memory and running persistence artifacts before evidence is captured, so it is eradication performed before containment and forensics are complete.

Isolating the asset keeps disk contents, memory, process state, and logs intact and on-network-readable by SecOps, allowing the responder to determine scope and root cause.

IOCs are a detection input: they decide whether a rule fires, so they can even add noise from stale indicators. The problem here is ranking the alerts that already fire, which requires asset-sensitivity context from the CMDB.

Ingested HVA records act as reference data rules can match against, letting detections score or escalate alerts on critical hosts, IPs, and users while downgrading activity on non-sensitive assets — improving the working positive ratio.

Yes, the rules may still fire, but low-impact alerts sink in priority so analysts spend time on high-value alerts first, which is what stops true positives from being missed in a high-volume queue.

A standard VirusTotal upload shares the sample and its scan results with the broader community and scanning vendors, which an advanced threat group monitoring for its custom tool would likely observe, ending your covert access to it.

The sample was developed specifically for your organization and is brand new, so its hash will not exist in any intelligence repository; a checksum lookup returns no behavior or IOC data about a file you already hold.

Risk Analytics only shows scores from pre-configured risk rules and does not let you pivot on specific IOCs. Use UDM Search first for direct correlation, then check risk signals as a follow-up.

Both are containment actions taken before you have evidence the logins are coordinated. Block or disable only after the search confirms the pattern and scope of the attack.

Risk Analytics scores Asset entities (hostnames, IPs, MACs) and User entities; domains are not tracked as standalone scored entities, so you cannot get domain prevalence or first-seen data there.

Those sources are already normalized into UDM, so a UDM search gives you consistent domain fields, entity mapping, and prevalence/first-seen enrichment that raw logs do not.

Applied Threat Intelligence is enabled, so newly observed and newly matched domain indicators appear there with first-seen and last-seen timestamps and an IOC drilldown into full context.

A scheduled job must wait for its next run to scan cases and attach a playbook, adding latency and complexity. Branching inside the triggered playbook with Flow Condition routes the case immediately and event-driven.

Multi-Choice Question flows pause the playbook for an analyst to read instructions and pick an answer, which is manual, slower, and error-prone. The question explicitly requires an automatic and efficient split.

A hash-linked high-frequency rule still depends on inconsistently captured process hashes, causing false negatives, and it only alerts on new events without retrohunting past EDR, DNS, and Sysmon telemetry.

Hashes are not reliably logged on all endpoints due to inconsistent Sysmon configuration, so a hash-only rule misses executions on affected hosts; behavioral correlation plus retrohunting is required.

They are behavioral event sources, so they add process and script telemetry but never supply the canonical user identity records needed to normalize principal.user.userid across sources.

Entra ID is the authoritative identity provider for those endpoints, and its audit and sign-in logs carry the user identifiers SecOps maps into principal.user.userid for YARA-L matches.

It converts raw entries only into additional.fields as generic key-value pairs, so the renamed field never reaches its core UDM field and dependent rules, dashboards, and detections keep failing.

Forking the entire parser duplicates a Google-maintained asset, increases maintenance overhead, and takes longer than an additive parser extension that only maps the two missing fields.

Feed management is built for pulling from cloud-resident sources such as Cloud Storage, Pub/Sub, and AWS/Azure feeds. Standalone on-premises Syslog endpoints are collected by a Bindplane agent installed at the source.

An ingestion label maps incoming data to a log type and its parsing schema. An asset namespace scopes asset identity so that identical IP addresses in different environments are tracked as separate assets instead of being aliased.