If you’ve done any sort of work in incident response, assessing alerts and deciding where to start can be overwhelming even in the best of times. It’s easy to overlook something important or be sidetracked by your hypochondriac IDS. This session will walk through basic triage along with an alert analysis and information collection checklist, so you have the right data to make the right decisions.