SOC / Blue Team · 5 min
Alert Triage
Deciding what to look at first
This lesson explains the concept, then checks your understanding in a short interactive exercise.
A triage framework
Working through a consistent set of questions helps you triage quickly and consistently.
- What triggered this alert?
- Who or what is affected?
- What happened before it?
- What happened after it?
- Is there corroborating evidence?
- What's the potential impact?
- What should happen next?
Priority isn't the alert name
An alert titled 'Critical' isn't automatically more urgent than one titled 'Medium.' Real priority comes from likelihood (how probable is this real?), context (what else is going on?) and impact (how bad would it be?) — considered together.
Loading the interactive lesson…