Imagine you’re an analyst working in a security operations center (SOC). An endpoint glows red on your dashboard, indicating that it’s trying to communicate with an unknown IP address. You check its running processes and see a binary that you don’t recognize, but the user may have installed it.

It could be nothing, but you’re not sure. You’ve only been in the job for six months, but on a Sunday afternoon, you’re the most senior person in the room. Your boss is at a wedding and told you not to disturb him unless there is an extreme emergency. What should you do?

Read full news article on Security Intelligence