SOC Analyst tasks

You work primarily from the Incidents page, sorting by Contrast score or severity to bring the most serious items to the top. Contrast creates an incident automatically, based on ADR rules, from one or more related issues and observations, when it detects an attack and will automatically correlate and adjust the Contrast score of the associated issues so that you are focused on the highest risk items.

Each incident in the list shows its severity, Contrast score, incident ID, status, affected applications, who it's assigned to, when it was created, and when it was last updated. For a wider view of where an incident sits in your environment, Explorer gives you a comprehensive map of your organization's application layer, applications, servers, called APIs, and databases, so you can see what else is connected to what's under attack.

Selecting an incident opens its Overview tab, which brings together the general details (source IP, severity, status, who it's assigned to, the rule or rules that triggered it, and its mapped MITRE ATT&CK tactic), a summary of the Contrast score and what happened, and its associated issues and assets.

For agents that support it, the incident trace gives you a graphical model of the application's behavior around the incident, entry points like routes, message queues, and API calls, and the specific actions Contrast observed there, such as database calls, file system access, or outbound requests. It's built to show you the path an attacker took, not just the single point where Contrast caught them.

From the incident's Overview tab, you have direct actions available without leaving Northstar:

From the incident, select through to its associated issues and review the How to fix guidance reported there. If the fix needs code changes, assign the incident to a developer to work on it. This is also where you decide whether ADR rules or CVE Shields need adjusting, for example, moving a noisy rule from Block to Monitor or the reverse, based on what you're seeing in practice.

Once you've verified the underlying issue is fixed and the incident is no longer being exploited, change its status to Closed on the Incidents page. Don't close on the strength of a deployed fix alone; confirm against the incident and issue data that the exploitation has actually stopped.