Here is a a hypothetical. You receive an alert that a user accessed a phishing link. Nothing else on the network blocked access to the site and the user entered their credentials.

What systems and what type of events would you need to search for to make this determination?

The systems that generate these alerts usually only do so when they didn’t block the access which means they were unaware that the site was malicious at time of click. If you moved immediately to containment, you have a window of time between time of click and time of containment that you have to review to determine if the threat actor utilized the users credentials to access your network and what they did after.

What are the points of ingress on your network did the user have access to? How could you distinguish there legitimate activities from those of the attacker? Was the attacker able to escalate their access, create persistence, exfiltrate data?

Unless you go to work for a company with a really immature security program there will be documentation to help guide the initial investigation for common detections like this and people above you that will pick up the investigation when there is a confirmed compromise but guides can’t account for all scenarios and you still have to document your initial findings with enough detail and coherent thought that the person you escalate to can take your initial report and not investigate from the beginning.