1.2. Signals, Alerts, and Incidents
💡 First Principle: Raw security data is too voluminous for humans, so a SOC works in layers of abstraction. Telemetry records everything that happened; detections decide which events are suspicious and raise alerts; correlation groups related alerts into incidents that describe one attack. Each layer trades detail for meaning, and analysts work at the highest layer that still answers their question.
Why care: almost every SC-200 question sits at one of these layers. "Which table holds process creation events?" is a telemetry question. "Which rule type raises an alert within a minute?" is a detection question. "How do you assign ownership and track response work?" is an incident question. Knowing which layer a question lives in removes half the distractors before you read them.
Notice the branch most people forget: events that don't match any detection aren't discarded. They stay in tables, which is exactly what hunting (Phase 4) and investigation (Phase 3) search.
⚠️ Common Misconception: "An alert and an incident are the same thing." An alert is one detection about one suspicious event or pattern; an incident is the correlated container of related alerts, entities, and evidence. You assign, prioritize, and resolve incidents. Treating each alert as its own case is how analysts miss that five "medium" alerts are one high-severity intrusion.
