From Influence to Evidence: Teaching the SOC Not to Make the Same Mistake Twice

Last summer I wrote about the Pyramid of Influence the idea that in a Human Augmented SOC, not all analyst feedback is equal. Clicking False Positive is Tier 1. It decorates the interface. But FP because powershell.exe is patch automation on this host that’s Tier 4. That’s not tagging, it’s teaching.