Giving every ESH-SOC analyst the same structure for investigating an alert
Every analyst at the ESH-SOC investigates alerts along the same four stages, and every new tier 1 analyst learns them in training. The structure comes from a study by TU/e and the SOC, in which analysts who followed it recognised alerts caused by attacks far more often.