Alert Triage Workflow

Alert triage is the process of reviewing incoming alerts, deciding which are real and important, and routing them appropriately. The goal is to separate signal from noise quickly.

Every alert lands in one of three buckets:

• True positive — real malicious or risky activity
• False positive — benign activity that looks suspicious
• Benign true positive — real but authorized or expected activity

An alert moves through a predictable lifecycle. Knowing each stage keeps your work organized:

• New — just generated by the SIEM or EDR
• In progress — an analyst is investigating
• Escalated — handed to Tier 2 or incident response
• Closed — resolved as false positive, benign, or remediated

Each transition should be reflected in the ticket so others can see the state at a glance.

Start by understanding exactly what fired. Read the detection rule and the raw event behind it. Ask:

• What rule triggered, and what does it actually detect?
• Which host, user, and process are involved?
• What is the timestamp and source IP/destination?

A common alert payload contains the core pivot points:

A raw alert rarely tells the full story. Enrichment adds context that helps you judge severity:

• Asset context — is this a server, a developer laptop, or a domain controller?
• User context — is this account privileged? Is the user on vacation?
• Threat intelligence — is the IP, domain, or hash known-bad?
• Historical baseline — has this host done this before?

A login from a sysadmin is very different from the same login on a crown-jewel database.

Indicators of compromise (IOCs) like IPs, domains, URLs, and file hashes should be checked against reputation and intelligence sources.

Useful lookups during triage:

Single events rarely confirm an incident. Pivoting means following one indicator to find related activity.

From a suspicious process, pivot to:

• Other processes spawned by the same parent
• Network connections made by that host around the same time
• Other hosts that contacted the same destination IP
• Authentication events for the involved user

Building this timeline is how a lone alert becomes a clear picture of an attack.

Not all true positives are equally urgent. Prioritize using two axes: impact and confidence.

• High impact + high confidence — escalate immediately (e.g. ransomware on a server)
• High impact + low confidence — investigate fast to confirm
• Low impact — handle in queue order

Asset criticality and blast radius drive impact. A compromised domain controller outranks a single user's spam alert.

The MITRE ATT&CK framework catalogs adversary tactics and techniques. Mapping an alert to ATT&CK helps you reason about what stage of an attack you are seeing and what might come next.

For example, an encoded PowerShell command maps to:

• Tactic: Execution
• Technique: T1059.001 (PowerShell)

If you also see Persistence or Lateral Movement techniques, the threat is progressing and urgency rises.

Most alerts are false positives. Learn the usual suspects so you can clear them confidently:

• IT admin tools that mimic attacker behavior (PsExec, scripting)
• Vulnerability scanners triggering network alerts
• Backup jobs causing large data transfers
• Developers running encoded or obfuscated test scripts

When you confirm a recurring false positive, recommend a tuning change so it stops generating noise.

Whether you close or escalate, document clearly. Good notes let the next analyst pick up instantly and protect you during audits.

A solid triage note includes:

• What the alert was and why it fired
• What you checked and the evidence (with timestamps and IOCs)
• Your conclusion and the disposition
• Any recommended follow-up or tuning

Vague notes like 'looks fine, closed' are useless and dangerous.

Escalate to Tier 2 or incident response when an alert is a confirmed or likely true positive with real impact. Do not sit on uncertainty when stakes are high.

Escalate immediately if you see:

• Confirmed malware execution or active C2 traffic
• Privileged account compromise
• Signs of lateral movement or data exfiltration
• Anything affecting a critical asset

When in doubt on a high-impact alert, escalate. Over-escalating a SEV1 is safer than missing one.

Test your triage prioritization skills.

You walked through the alert triage workflow:

• Triage sorts alerts into true positive, false positive, or benign true positive
• Read the alert, then enrich with asset, user, and threat-intel context
• Pivot across data to build a timeline and confirm scope
• Prioritize by impact and confidence, and map activity to MITRE ATT&CK
• Document findings clearly and escalate high-impact true positives without delay

Next, you will learn how playbooks and ticketing make this process repeatable.