Despite the abundance of telemetry at analysts’ disposal, many security operations teams struggle to answer a few basic questions during incident investigation: What happened? What evidence do we have? How do we know we’re seeing it all, in context?

Answering these questions requires teams to go beyond alerts, the most common basis for initial triage. But investigations (and their outcomes)