Module
Alert Triage Fundamentals
Take an alert from the queue and, in about fifteen minutes, call it malicious, a false alarm or real but harmless. Then close it or escalate it with a note the next analyst can act on without asking you anything.
65 min · Beginner
Start Alert Triage Fundamentals
What you will learn
- Read an alert as a claim about specific evidence, and know what its rule cannot see
- Run five triage questions in order and stop when the triage question is answered
- Sort an alert into true positive, false positive or benign true positive, and know what each one costs
- Write a close or escalation note with what you checked, found and did not check
- Work a new alert from first look to closed, unaided
Lessons
What the Alert Is Actually Claiming
An alert title is the name of a rule. The finding is the event that matched it, and the edges of the rule decide what its silence is worth.
The First Five Minutes
Five questions, in the same order, every time. Triage answers whether this deserves more time and how urgently, and then it stops.
Malicious, False Alarm, or Real but Harmless
False positive does not mean nothing happened. Three outcomes, three costs, and how to weigh facts that point both ways.
Close It or Escalate It
Escalating is not the safe option and "FP" is not a note. Five lines the next person can act on.
One Alert, Start to Finish
Impossible travel, worked from first look to closed with no help. It looks like a compromise. It is something else.