# Identification

### Overview <a href="#overview" id="overview"></a>

The identification stage is crucial for confirming potential threats found during the investigation and separating true threats from false positives.

### **Confirming Threats** <a href="#confirming-threats" id="confirming-threats"></a>

1. **Validation**: Check findings against known threat behaviors and indicators.
2. **Context Analysis**: Evaluate how the findings impact or relate to your specific environment.

### **Separating False Positives** <a href="#separating-false-positives" id="separating-false-positives"></a>

* **Correlation**: Confirm anomalies by linking them with other suspicious activities.
* **Behavior Analysis**: Analyze the behavior of anomalies to determine if they are harmful.

### **Using Tools Effectively** <a href="#using-tools-effectively" id="using-tools-effectively"></a>

* **Automated Tools**: Employ automation for quick and broad analysis.
* **Manual Review**: Use manual checks to ensure the accuracy and relevancy of results.
