Case Scenario#1: Inbound email Containing Suspicious External Link

Case Report:

Alert: #8814 — Inbound Email Containing Suspicious External Link

False Postive Case

Alert Type: Phishing

What triggered the alert:

An inbound onboarding email contained an external link, which triggered the phishing detection rule.

Evidence Reviewed:

I reviewed the sender, recipient, subject, email body, and external link for suspicious characteristics. The message appeared to be related to employee onboarding, and I did not identify obvious malicious indicators during my initial review.

Finding:

I determined that the alert was a False Positive because the activity was associated with legitimate/expected internal activity and I did not identify malicious indicators.

Action taken:

I documented the investigation and closed the alert as a False Positive.

What I learned:

An alert does not automatically mean an attack occurred. But a SOC analyst needs to investigate the context and supporting evidence before deciding whether an alert is a True Positive or False Positive.