## Alert Triage & Investigation

The core loop of the SOC Analyst.

### 1. Validation (True or False?)
*   **Alert**: "SQL Injection Detected from 1.2.3.4".
*   **Check**: Look at the HTTP Response Code.
    *   if **200 OK**: The server accepted it. **True Positive**. (BAD).
    *   if **500 Error**: The server crashed. **True Positive**. (BAD).
    *   if **403 Forbidden**: The WAF blocked it. **True Positive (Blocked)**. (Good).
    *   if **404 Not Found**: Scanner. **True Positive (Attempt)**.

### 2. Context
*   **Source IP**: Is it internal or external? Is it a known scanner (Shodan)?
*   **Dest IP**: Is it a Critical Server or a Test Box?

### 3. Investigation
*   Checking other logs. "Did the endpoint spawn a shell right after this?"

### 4. Categorization
*   **True Positive**: Real Attack.
*   **False Positive**: Normal traffic flagged as bad. (e.g., Admin running a backup script looks like data exfil).
*   **False Negative**: Attack happened, but NO alert fired. (The worst case).