Extras · 1 of 4

A typical day

Take the handover from the previous shift, then work the alert queue: a login from an unusual country, a laptop talking to a suspicious address, someone plugging in a device they should not have. Most alerts are nothing and you close them with a note. A few are real, and then it is fast: isolate the machine, pull the logs, work out what touched what, tell the people who need to know. In between, tuning detection rules so the same false alarm stops waking people at 3am.