Parsing alerts
Where this fits in Alert
Parsing Breaking a raw alert, log line, or command string into its component fields so each can be examined on its own: the user, the host, the action, the time. In triage, parsing the alert is the first move; the details that decide a verdict live in the fields, not in the alert name. is the third pillar of the Alert chapter. Detection mechanisms explained how the engine decided. Validation tested whether the signal is real. Parsing extracts the Metadata Data about data: file timestamps, owner, size, hash; an email's headers; a process's parent, command line, and signing certificate. In triage, metadata is often more diagnostic than the content itself. at the level of detail the rest of the investigation needs. Without it, the analyst is working with an abstraction.
This matters because adversaries hide their intent inside the very fields you would parse. An EDR alert might report powershell.exe executing with an encoded command parameter. Without parsing, the underlying command (and the attacker’s intent) stays obscured.
What parsing has to handle
Modern SOCs ingest logs from legacy Syslog A standard protocol for message logging in network devices and systems. all the way to cloud-native JSON. Parsing frameworks have to normalize that into queryable, structured data, and they have to do it while the adversary is actively trying to hide.
Obfuscated scripts
PowerShell or Python encoded to dodge plain-text matching.
Fileless malware
Payloads that live in memory with minimal on-disk footprint.
Living off the land
Native binaries executing malicious operations under their legitimate signature.
Partial metadata
Alerts with truncated command lines, missing parent process information, or incomplete context.
Good parsing decodes these patterns while preserving the context downstream phases need.
One layer, five surfaces
Field extraction is the floor. Above it, advanced parsing reconstructs adversary behavior across five Telemetry Collection and transmission of security-relevant data from remote sources for monitoring and analysis. surfaces: command lines, process relationships, network activity, file system activity, and the cloud control plane. Beneath all five sits a normalization layer that is not a behavioral surface at all, but the plumbing that determines whether the surfaces can be read as one dataset. Each gets its own page.
Formats and normalization
Windows Event Logs, syslog, CEF, JSON. The per-platform telemetry sources behind them, and the schemas (OCSF, STIX, OpenC2) that give everything one shape.
Read →01🖥️Command line analysis
Decode the true intent of process execution. The encoded-command workflow, Base64 and caret obfuscation, abbreviated flags, the 4688 gap, execution context.
Read →02🔗Process relationships
Parent-child chains and lineage reconstruction on Windows and macOS. Macro-execution chains, persistence, hollowing, token theft, signature chains.
Read →03🌐Network correlation
Tie host activity to outbound traffic. C2 detection through timing, TLS, DNS, and exfiltration indicators.
Read →04📁File system activity
Persistence, payload deployment, ransomware staging, exfiltration prep. Tracking the file lifecycle and metadata.
Read →05☁️Cloud and identity logs
The control plane as a surface. CloudTrail record anatomy, role chains and STS, the IMDS pattern, IdP sign-in logs.
Read →Three categories of information from every alert
Whatever surface you are parsing, the output should populate three buckets:
Who saw it, when, how confident, what bucket it fits.
- Alert ID and timestamp for unique identification and temporal sequencing.
- Source system and detection mechanism (which engine fired, under what logic).
- Severity and confidence to guide triage priority.
- Category and classification (privilege escalation, lateral movement, exfiltration).
The investigative substance.
- Affected systems and accounts (endpoints, servers, identities involved).
- Network information (IPs, ports, protocols, session IDs).
- File and process information (paths, hashes, command-line parameters).
- Registry and configuration changes (persistence, policy mods, drift).
The organizational lens.
- Business impact (what does this potentially disrupt).
- Regulatory implications (HIPAA, PCI DSS, GDPR triggers).
- Historical correlation (does this fit a recurring pattern or campaign).
- Threat intelligence (known IoCs, adversary TTPs, campaign signatures).
Key Takeaway
Parsing turns raw output into investigative input. Each of the five surfaces gives you a different angle on adversary intent, and the normalization layer is what lets you read them as one dataset. Combined, they form the technical foundation the rest of ASSURED depends on.
Next up
Formats and normalization
Start with the layer. Windows Event Logs, syslog, CEF, JSON, the per-platform telemetry sources, and the schemas that give them one shape.
Begin with normalization