Field guide / Reviewed October 31, 2026
The alert is open. Start with its question.
You are not expected to infer an entire incident from an alert title. Start by finding the event that caused the rule to match.
Write the detection reason in plain terms.
“Suspicious sign-in” is a label. “This rule matched a successful sign-in from a network not previously recorded for this account” describes a question you can investigate. If the rule logic is unavailable, say that. Do not guess what a vendor label means.
Microsoft Sentinel recommends establishing why an incident was raised and using its events, entities and timeline to investigate. The important habit is preserving the link between a statement and its supporting record. Microsoft incident investigation.
Use a small initial boundary.
- Identify the event: alert ID, detection rule, timestamp and source.
- Identify the entities: account, device, application or service actually named in the record.
- Check the result: did the attempt fail, succeed, queue, or return an unknown outcome?
- Define your window: record timezone, the period searched and which sources you can access.
- Pick the next question: choose the missing fact most likely to change the next analyst's action.
This sequence is an editorial starting point, not a universal priority policy. An urgent local escalation rule takes precedence over completing a worksheet.
A small example, with a useful limit.
Synthetic observation: Event S1 reports a successful sign-in for user-07 at 09:12 UTC. The supplied event has no device details.
Hypothesis: The sign-in could be unauthorized.
Next question: Can the identity owner supply device context and confirm whether the activity was expected?
The hypothesis is not an observation. The missing device record is not evidence of an unmanaged device. These distinctions let the next analyst make progress without undoing an unsupported conclusion.
“No matches” needs a boundary.
Record the source, query or filter reference, time range, collection coverage and retention. “No matching audit records in the supplied 30-minute training extract” is defensible. “No suspicious activity” claims much more.
Splunk Enterprise Security exposes contributing events and investigation context around a notable event. Use that context in your approved console and preserve references in the handoff. CaseNote does not connect to the console or query it for you. Splunk ES 7.3 investigation guide.