Alert Triage
Overview
Alert triage reviews, validates, classifies, and prioritizes security alerts to determine whether they represent a real threat.
Key concepts
- False positive vs. false negative vs. true positive
- Benign true positives
- Severity, priority, asset criticality, escalation
How it works
Alert triage is the process of reviewing, validating, classifying, and prioritizing security alerts to determine whether they represent a real threat. The goal is to quickly sort an alert into: false positive, benign activity, suspicious activity, or a confirmed incident.
Classifying an alert
| Term | Meaning |
|---|---|
| False positive | Appears malicious or suspicious but is actually harmless. |
| False negative | A real security event the detection system fails to identify. |
| True positive | Correctly identifies real malicious or unauthorized activity. |
| Benign true positive | Triggered by real activity that's authorized or expected — e.g. an admin doing approved maintenance. Distinguishing this from genuinely suspicious activity is a core reason SOC teams exist; without that judgment, every flag against legitimate activity would waste time and energy. |
Prioritizing an alert
| Term | Meaning |
|---|---|
| Severity | A rating of the potential seriousness of an alert or incident. |
| Priority | The order alerts should be handled in, based on severity, confidence, asset importance, and business impact. |
| Asset criticality | How important a system or device is to the organization's operations, security, or sensitive data. |
| Scope | The number of systems, users, accounts, applications, or data sources affected. |
| Escalation | Passing an alert or incident to a more experienced analyst, IR team, manager, or other responsible group. |