I'm quite new to the security field and learning my ways on how to triage certain events.
One such alert that I see is "Phishing" when a user clicks on a malicious link. As far as triaging to see if that device is compromised, I'm not too sure what else to do to confirm if it was.
When I investigate the event, it gives me the URL which is
To triage, I do the below:
- Go to virustotal (or other sites) and verify if the URL is indeed malicious
- Check the device (user laptop) in question and run a scan with the anti virus software
- Verify that there are no active communication between the device and the phishing website
Aside from performing the above steps to triage, are there any other steps I can perform to ensure that the device is indeed not compromised?