Alert Triage and SOC Workflow
Prioritize alerts, reduce false positives, and follow a SOC analyst triage workflow.
The SOC Analyst Role
SOC analysts are the first responders to security alerts. Their job: quickly determine if an alert represents a real threat, gather evidence, escalate genuine incidents, and close false positives — at scale, often handling dozens of alerts per shift.
Alert Severity Tiers
Alerts are classified by severity: P1 (Critical — active compromise), P2 (High — probable attack), P3 (Medium — suspicious activity), P4 (Low/Informational — policy violation or misconfiguration).
# Severity SLAs:
# P1 Critical: Respond within 15 minutes
# P2 High: Respond within 1 hour
# P3 Medium: Respond within 4 hours
# P4 Low: Respond within 24 hours
# SLAs drive staffing and escalation policy