A school-district SOC sees suspicious process creation on a teacher laptop and a matching unusual sign-in. Which investigative approach strengthens the conclusion?

Strong investigation conclusions come from correlating independent telemetry along the attack or misuse path. When a school-district SOC sees suspicious process creation on a teacher laptop alongside an unusual sign-in, linking EDR process, parent process, hash, and network connection data with identity provider or directory authentication logs shows whether the same account, time window, and source context explain both events. That correlation distinguishes malware-driven execution with credential abuse from a benign admin tool coincidentally near a travel login, and it supports containment decisions with higher confidence than either signal alone.

Ignoring identity logs and defaulting the EDR alert to false positive discards half the evidence and invites missed account compromise. Deleting authentication events to “simplify” a ticket destroys audit history and may violate retention or investigative policy. Reimaging immediately without capturing volatile memory, EDR timeline, or logs eradicates evidence needed for root cause and scope. Exam tip: stems that mention both endpoint and sign-in anomalies reward correlation across host and identity sources. Operationally, preserve EDR detections and auth logs before remediation, align clocks via NTP, document the correlated timeline in the ticket, and only then isolate or reimage the teacher laptop once evidence collection criteria for the district’s IR process are met.