Reading any alert
On this page
Reading an alert means parsing it: extracting meaning from raw detection output. The engine produces a blob of fields (names, timestamps, paths, command lines, IPs). Parsing turns that blob into structured, actionable investigative input, and the checklist on this page works for any alert from any source.
Where this fits in Alert
Parsing Parsing Breaking a raw alert, log line, or command string into its component fields so each can be examined on its own: the user, the host, the action, the time. In triage, parsing the alert is the first move; the details that decide a verdict live in the fields, not in the alert name. Alert parsing and log parsing are the same move applied to different inputs. is the third pillar of the Alert chapter. Detection mechanisms explained how the engine decided. Validation tested whether the signal is real. Parsing extracts the metadata Metadata Data about data: file timestamps, owner, size, hash; an email's headers; a process's parent, command line, and signing certificate. In triage, metadata is often more diagnostic than the content itself. at the level of detail the rest of the investigation needs. Without it, the analyst is working with an abstraction.
This matters because adversaries hide their intent inside the very fields you would parse. An EDR alert might report powershell.exe executing with an encoded command parameter. Without parsing, the underlying command (and the attacker’s intent) stays obscured.
What parsing has to handle
Modern SOCs ingest everything from plain-text syslog Syslog A standard protocol for message logging in network devices and systems (RFC 5424; legacy BSD format RFC 3164). Classic syslog over UDP 514 drops messages silently, can be spoofed, and RFC 3164 timestamps lack year and timezone, so normalize time before correlating. to cloud-native JSON. Parsing frameworks have to normalize that into queryable, structured data, and they have to do it while the adversary is actively trying to hide.
Obfuscated scripts
PowerShell or Python encoded to dodge plain-text matching.
Fileless malware
Payloads that live in memory with minimal on-disk footprint.
Living off the land
Native binaries executing malicious operations under their legitimate signature.
Partial metadata
Alerts with truncated command lines, missing parent process information, or incomplete context.
Good parsing decodes what can be decoded, enriches what can be looked up, records what was never captured as a named visibility gap, and preserves the context downstream phases need.
The checklist
Nine steps, in order, for any alert. Not every alert needs every step: skip the ones the alert has no data for, and say so in the record. Each step links to the telemetry page that teaches it in depth.
- Find the raw record. Open the source event, not only the console’s parsed view, and note which telemetry source and format produced it. Fields the parser dropped or renamed are still in the raw record. See formats and normalization.
- Fix the clock. Convert every timestamp to UTC in RFC 3339 form, and note whether it is event time or ingest time. An RFC 3164 syslog line carries no zone and no year, so the collector decided its time.
- Name what was not captured. An empty field is a fact about telemetry. “Command line not captured (4688 policy off)” is a finding; “no command line” is a guess. Record each gap, so later phases do not read absence as evidence.
- Decode what can be decoded. Look for the decoded script in PowerShell’s 4104 events first, then decode by hand (Base64, then UTF-16LE). Normalize flag prefixes before you match on them. See command line analysis.
- Rebuild the lineage on unique IDs. Join parent and child on
ProcessGuidor the EDR’s process ID, never on PID alone. Check the creator against the reported parent, and read a macOS signature, Team ID, notarization and install path as evidence about provenance, not behavior. See process relationships. - Tie each connection to a process. Join the process half (Sysmon Event ID 3, EDR network events) to the wire half (proxy, firewall, Zeek, flow logs) on addresses, ports and time. Keep what you observed separate from what you infer, and name the benign twin. See network correlation.
- Check what landed, and where it came from. File creates, persistence locations on every platform, and the Mark of the Web or the macOS quarantine attribute on anything downloaded. See file system activity.
- For cloud and identity alerts, read the verb and the actor. The API call, the identity behind it, and the role chain joined on stable keys; for sign-ins, interactive or non-interactive, and the session ID. See cloud and identity logs.
- Redact, then record. Strip passwords, tokens and session cookies before anything goes into a ticket, a chat or an AI assistant, and keep the raw original in the evidence store. Then fill the three buckets below and hand them to Subject with the gaps named.
Reading telemetry: one layer, five surfaces
Field extraction is the floor. Above it, advanced parsing reconstructs adversary behavior across five telemetry Telemetry The event streams that endpoints, network sensors, identity providers, SaaS apps and cloud control planes emit about what happened on them. Triage can only see what was collected: when telemetry is missing for a host or time window, record it as a gap (unknown is not Low), not as clean. surfaces: command lines, process relationships, network activity, file system activity, and the cloud control plane. Beneath all five sits a normalization layer that is not a behavioral surface at all, but the plumbing that determines whether the surfaces can be read as one dataset. Each gets its own page. The six pages are field reference: read the one an alert sends you to, when it sends you there, rather than all six in one sitting.
Formats and normalization
Windows Event Logs, syslog, CEF, JSON. The per-platform telemetry sources behind them, and the event schemas (OCSF, ECS, CIM, ASIM, UDM) that give everything one shape.
Read →01Command line analysis
Decode the true intent of process execution. The encoded-command workflow, Base64 and caret obfuscation, abbreviated flags, the 4688 gap, execution context.
Read →02Process relationships
Parent-child chains and lineage reconstruction on Windows and macOS. Macro-execution chains, persistence, hollowing, token theft, signature chains.
Read →03Network correlation
Tie host activity to network traffic, outbound and east-west. C2 detection through timing, TLS, DNS, and exfiltration indicators.
Read →04File system activity
Persistence, payload deployment, ransomware staging, exfiltration prep. Tracking the file lifecycle and metadata.
Read →05Cloud and identity logs
The control plane as a surface. CloudTrail record anatomy, role chains and STS, the IMDS pattern, IdP sign-in logs, and identity attacks at protocol depth, including Kerberos.
Read →Three categories of information from every alert
Whatever surface you are parsing, the output should populate three buckets:
Who saw it, when, how confident, what bucket it fits.
- Alert ID and timestamp for unique identification and temporal sequencing.
- Source system and detection mechanism (which engine fired, under what logic).
- Severity and confidence to guide triage priority.
- Category and classification (privilege escalation, lateral movement, exfiltration).
The investigative substance.
- Affected systems and accounts (endpoints, servers, identities involved).
- Network information (IPs, ports, protocols, session IDs).
- File and process information (paths, hashes, command-line parameters).
- Registry and configuration changes (persistence, policy mods, drift).
The organizational lens.
- Business impact (what does this potentially disrupt).
- Regulated-data flags (asset or dataset tagged PHI, cardholder data, personal data) for Scope to evaluate.
- Historical correlation (does this fit a recurring pattern or campaign).
- Threat intelligence (known IOCs, adversary TTPs, campaign signatures).
Key takeaway
Parsing turns raw output into investigative input. The checklist is the same for every alert: raw record, clock, gaps, decode, lineage, connections, files, identity, then redact and record. Each of the five surfaces gives you a different angle on adversary intent, and the normalization layer is what lets you read them as one dataset.
Next up
Alert working example
Three cases worked through the Alert phase: a paste-and-run chain on a finance laptop, an Empire-pattern alert in a developer's IDE, and a replayed session on the mail tenant. The telemetry pages above stay as the field reference.
Work the casesTechnical details verified . Product names, defaults and retention change; check your own tenant.