You get a call at 2am. Your SOC alerts show unusual outbound traffic from a privileged account. The user…

Comments

Micah R.: Im suprised to see that revoking the users privelages is the most chosen. what if it is a legitiate action? I feel the safest responce would be to isolate, then find out if its legitimate and then go from there .That way you are not cutting off someone who may be doing important work. And having to issue new credentials. If after investigation you find its not legit than yes revoke the credentials

KENNEDY A.: Immediately isolate the affected system to contain potential compromise, then follow the incident response plan and notify the appropriate stakeholders.

Everett D.: It really comes down to how the SOC rule is written and interpreted. In general a SOC is going to employ some type of SOAR and the fact nothing automated triggered against a PAM account or the device other than the alert it was utilizing suggests one should not jump to conclusions. A safe bet is to understand it better before further affecting it or losing forensic artifacts.