Follow the analyst’s investigation and response path

The review covered behavioural and signature detection, STAR rules, Storyline correlation, process and file evidence, quarantine, process termination, isolation and remediation. I assessed these against operational SOC requirements and kept demonstrated behaviour separate from features requiring further configuration or testing.