How to investigate like an Expel analyst: The Expel Workbench managed alert process

This blog post explains Expel’s managed alert process (MAP) and the OSCAR investigative framework for SOC analysts, describing how alerts move through triage, investigation, incident, close, and notify states; it highlights decision-support tools, investigative actions (queries and artifact acquisition), and automation (Ruxie). An example walkthrough (macro-enabled document leading to obfuscated PowerShell downloader behavior) demonstrates how analysts collect evidence, analyze obfuscated payloads, use OSINT, and escalate malicious findings to incidents, emphasizing consistent, question-driven investigations rather than rote runbooks.