Moving from an alert to a response decision

I followed SIEM and SOAR events into packet captures, process trees and host, network, cloud and SaaS records. I used timelines and frequency analysis to assess suspicious activity and explained the supported root cause, impact and remediation to the client.