An analyst reviews an alert raised by the SOC's machine learning detection model, which flagged a finance workstation for anomalous outbound traffic. The model reports a confidence score of 0.42 and no supporting rule or signature match. Before escalating, what should the analyst do first?
ml_alert: host=FIN-WS07 class=beaconing confidence=0.42
supporting_signatures: none
raw_flows: 443/tcp to 203.0.113.9, 5 conns/hour- AEscalate the alert to incident response immediately because the detection model classified the host as beaconing.
- BSuppress the alert and retrain the model, since a 0.42 confidence indicates the detection logic is faulty.
- CBlock the destination address at the firewall before any further review of the traffic.
- DValidate the model output by examining the underlying flow evidence to confirm whether the behaviour is genuinely anomalous. Correct
Why A is wrong: Tempting because ML output can feel authoritative, but escalating an unvalidated low-confidence flag wastes response resources and skips triage.
Why B is wrong: Tempting because low confidence looks like a model defect, but a single low score is not evidence of a broken model and suppression hides a possible true positive.
Why C is wrong: Tempting as a fast containment move, but blocking on an unconfirmed low-confidence flag risks disrupting legitimate business traffic without evidence.
Why D is correct: Correct: a low-confidence ML flag with no corroborating signature is a lead, not a verdict, so the analyst confirms it against the raw evidence before acting.