Alert Triage and SOC Workflow
Prioritize alerts, reduce false positives, and follow a SOC analyst triage workflow.
Alert Triage and SOC Workflow is a free Cyber Security Academy lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
The SOC Analyst Role
SOC analysts are the first responders to security alerts. Their job: quickly determine if an alert represents a real threat, gather evidence, escalate genuine incidents, and close false positives — at scale, often handling dozens of alerts per shift.
Alert Severity Tiers
Alerts are classified by severity: P1 (Critical — active compromise), P2 (High — probable attack), P3 (Medium — suspicious activity), P4 (Low/Informational — policy violation or misconfiguration).
# Severity SLAs:
# P1 Critical: Respond within 15 minutes
# P2 High: Respond within 1 hour
# P3 Medium: Respond within 4 hours
# P4 Low: Respond within 24 hours
# SLAs drive staffing and escalation policyThe Triage Process
Triage steps for every alert: 1) Read the alert — what triggered it? 2) Look at raw logs — is there real evidence? 3) Assess context — who/what/where? 4) Determine true positive, false positive, or benign positive.
True Positive vs False Positive
True positive (TP): alert fired and the activity is genuinely malicious. False positive (FP): alert fired but the activity is legitimate. Benign positive: alert fired on real unusual activity that is not malicious (e.g., pen test, admin activity).
Contextual Investigation
When triaging, gather context: What user? What host? What is their role? Is this their normal behavior? What happened before and after? Use SIEM, EDR, threat intel, and HR/IT context together.
# Questions to answer during triage:
# WHO: User identity, role, department
# WHAT: Process, command, file, network
# WHEN: Time, duration, business hours?
# WHERE: Source IP, geolocation, host
# WHY: Is there a business reason?
# HOW: Attack technique, lateral movement?Using Playbooks
Playbooks are documented step-by-step procedures for common alert types. They ensure consistent, repeatable triage and reduce analyst decision fatigue. Every alert type should have a playbook.
# Example playbook: Brute Force Alert
# 1. Check alert: source IP, target accounts
# 2. Query: successful logon after failures?
# 3. If yes: escalate to P1, isolate host
# 4. If no: check IP reputation
# 5. Malicious IP: block + document
# 6. Legitimate IP: tune rule, close FPEscalation Workflow
When an alert is confirmed as a true positive: escalate to IR team (P1/P2), document findings (timeline, affected assets, attack vector), preserve evidence before remediation, and notify stakeholders per escalation matrix.
Ticketing and Documentation
Every alert must be documented in a ticketing system (Jira, ServiceNow, TheHive): alert source, initial triage findings, disposition (TP/FP), actions taken, and closure reason. This creates an audit trail and enables metrics.
SOC Metrics
Key metrics: Mean Time to Detect (MTTD), Mean Time to Respond (MTTR), alert volume by severity, false positive rate per rule, and analyst tickets closed per shift. Use metrics to identify rule quality issues and staffing gaps.
Shift Handover
Shift handover is critical: document open incidents, ongoing investigations, and recently tuned rules. The incoming analyst should be able to pick up exactly where the outgoing left off without gaps in coverage.
Avoiding Alert Fatigue
High false positive rates burn analysts out and cause real alerts to be dismissed. Regularly review and retire poorly performing rules. A 90%+ false positive rate on any rule means it needs immediate tuning or retirement.
Quick Check
What is a "benign positive" in SOC triage?
Summary: SOC Workflow
Effective SOC operations depend on consistent triage, documented playbooks, clear escalation paths, and rigorous metrics. Every alert gets a documented disposition. Reduce false positives relentlessly to keep analyst attention on real threats. MTTD and MTTR are the north star metrics — they measure how quickly you detect and respond to real incidents.
Frequently asked questions
Is the “Alert Triage and SOC Workflow” lesson free?
Yes — the full text of “Alert Triage and SOC Workflow” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Alert Triage and SOC Workflow”?
Prioritize alerts, reduce false positives, and follow a SOC analyst triage workflow. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Alert Triage and SOC Workflow” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.