Notifications
Clear all
Topic starter
06/09/2026 9:33 am
TL;DR: Routine malware triage can consume ninety minutes when analysts must pivot between SOAR, EDR, network telemetry, and case templates just to prove a benign alert, according to Crogl. The real automation opportunity is evidence assembly and correlation, while judgement, verdicting, and auditability remain human responsibilities.
NHIMG editorial — based on content published by Crogl: The Ninety-Minute Routine Alert
Questions worth separating out
Q: What should SOC teams automate in email triage first?
A: SOC teams should automate the sorting, enrichment, and prioritisation of suspicious messages before automating any irreversible response.
Q: Why do analysts still spend so long on routine malware alerts?
A: Because the hard part is often not seeing the alert, but proving what it means across fragmented telemetry.
Q: How do you know if SOC automation is actually helping?
A: SOC automation is helping when it reduces repetitive work, improves triage quality, and shortens the time between signal and decision.
Practitioner guidance
- Automate evidence stitching before analyst review Connect SOAR, EDR, proxy, and firewall telemetry so hostname, process lineage, timestamps, and parent-child relationships are assembled automatically into the case.
- Replace desktop case templates with structured investigation records Move the case format into the platform so each field is populated from source telemetry rather than copied from a Word document on an analyst desktop.
- Create investigation views for repeated correlation tasks Prebuild queries and saved views for process lineage, adjacent alert activity, and network history so analysts do not repeat the same three-query pattern on every case.
What's in the full article
Crogl's full blog covers the operational detail this post intentionally leaves for the source:
- The step-by-step analyst workflow across SOAR, EDR, and network consoles that shows where the ninety minutes went.
- The specific evidence fields the analyst copied into the case template and why each one mattered for the final verdict.
- The remote response and file inspection sequence used to inspect quarantined files and document findings for handoff.
- The practical rationale for keeping judgement with the analyst while automating the repetitive work around it.
👉 Read Crogl's analysis of the ninety-minute SOC alert triage routine →
SOC evidence-building: what automation should and should not replace?
Explore further
06/09/2026 9:34 am
Evidence-building is the real SOC control surface, not the alert itself. The article shows that detection value collapses if analysts must still manually assemble process trees, network context, and case notes before a verdict can stand. That means the operational unit of control is the evidentiary chain, not the alarm. For teams managing identity signals, this is especially relevant because suspicious access, policy bypass, and workload activity often need the same reconstruction. The practitioner conclusion is clear: automate evidence assembly, not accountability.
A question worth separating out:
Q: What is the difference between automating triage and automating the verdict?
A: Automating triage means collecting, normalising, and correlating evidence so an analyst can investigate quickly. Automating the verdict means the system decides whether the activity is malicious, benign, or uncertain. The first is usually appropriate; the second creates governance risk if the reasoning trail is weak or opaque.
👉 Read our full editorial: SOC automation fails when evidence-building stays manual
