{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/alert-triage","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/alert-triage/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/alert-triage/"},"term":{"en":"Alert triage","da":"Triage af alarmer"},"aka":{"en":["alarm triage"],"da":["alarmtriage"]},"domain":["security"],"cluster":"security-operations","layer":"people","status":"current","summary":{"en":"Sorting incoming alarms quickly into real threats, harmless noise and cases that need a closer look, so the worst get handled first.","da":"Hurtig sortering af indkomne alarmer i reelle trusler, harmløs støj og sager, der kræver et nærmere kig, så de værste håndteres først."},"body":{"formal":{"en":"The first step of handling an alarm, in which an analyst checks its context, decides whether it points to a real security incident, gives it a priority and either closes it or passes it on - up to management when the harm could be serious.","da":"Det første trin i håndteringen af en alarm, hvor en analytiker undersøger sammenhængen, afgør, om den peger på en reel sikkerhedshændelse, giver den en prioritet og enten lukker den eller sender den videre - helt op til ledelsen, når skaden kan blive alvorlig."},"plain":{"en":"Like the nurse at a hospital's emergency desk who looks at everyone coming in and decides who sees a doctor now, who can wait, and who can go home.","da":"Som sygeplejersken i skadestuens modtagelse, der ser på alle, der kommer ind, og afgør, hvem der skal til lægen nu, hvem der kan vente, og hvem der kan gå hjem."},"inPractice":{"en":"Of forty overnight alarms in a region's SOC, the analyst closes thirty-five as a known backup job, groups four into one case about a single laptop, and sends the last - an admin login from abroad - straight to the on-call lead.","da":"Af fyrre alarmer i en regions SOC i løbet af natten lukker analytikeren 35 som et kendt backupjob, samler fire i én sag om en enkelt bærbar og sender den sidste - et admin-login fra udlandet - straks videre til den vagthavende leder."},"whyItMatters":{"en":"A team cannot look deeply at every alarm, so the quality of this first sort decides whether a real attack is caught in minutes or lost among hundreds of harmless ones.","da":"Et team kan ikke gå i dybden med hver alarm, så kvaliteten af den første sortering afgør, om et reelt angreb fanges på minutter eller drukner blandt hundredvis af harmløse."}},"deepDive":{"en":"In frameworks, triage sits at the boundary between detection and response. NIST CSF 2.0 separates the analysis of adverse events in the Detect function (DE.AE, including DE.AE-08, declaring an incident when events meet defined criteria) from incident management in Respond, where RS.MA-02 requires that incident reports are triaged and validated and RS.MA-03 that incidents are categorised and prioritised. NIST SP 800-61 Rev. 3 (2025) maps its incident response guidance onto these CSF outcomes instead of the older four-phase lifecycle. In practice a SOC works through a tiered model: Tier 1 analysts perform initial triage against a runbook, Tier 2 investigates escalated cases, and Tier 3 or incident response handles confirmed compromises.\n\nA triage decision typically follows a fixed sequence. The analyst validates that the alert fired on real telemetry, enriches it with context (asset criticality and owner, user role, recent authentication history, threat intelligence on hashes, IPs and domains, related alerts on the same host or identity), determines a disposition and assigns a severity. Useful dispositions distinguish true positives (malicious activity), benign true positives (the rule matched the intended behaviour but it was authorised, such as a penetration test or an administrator's legitimate PowerShell), false positives (the rule matched something it should not have) and undetermined. Recording the disposition precisely matters, because it is the feedback signal for tuning detection rules; lumping benign true positives in with false positives leads to rules being weakened for the wrong reason.\n\nPrioritisation usually combines the alert's severity with the business impact of the affected asset, giving a matrix rather than a single score. Grouping related alerts into one case, deduplication, and correlation by entity reduce volume before a human sees it; SOAR playbooks commonly automate enrichment and the closure of well-understood benign patterns. Metrics include mean time to acknowledge, mean time to triage, alert volume per analyst and the true-positive rate per rule. The chronic failure mode is alert fatigue: when most alerts are noise, analysts close them by pattern and miss the rare real one, which is why detection engineering and triage quality are inseparable.\n\nTriage also drives regulatory clocks. Under NIS2 Art. 23, an essential or important entity must send an early warning within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours; under GDPR Art. 33(1), a personal data breach must be notified to the supervisory authority, in Denmark Datatilsynet, within 72 hours of the controller becoming aware of it. The point at which triage establishes awareness therefore needs to be timestamped and documented. Triage differs from threat hunting, which starts from a hypothesis rather than an alert, and from full investigation, which reconstructs scope and root cause after the case has been escalated.","da":"I rammeværkerne ligger triage på grænsen mellem detektion og respons. NIST CSF 2.0 adskiller analysen af uønskede hændelser i Detect-funktionen (DE.AE, herunder DE.AE-08, hvor en hændelse erklæres, når hændelserne opfylder fastsatte kriterier) fra hændelseshåndtering i Respond, hvor RS.MA-02 kræver, at hændelsesrapporter triageres og valideres, og RS.MA-03, at hændelser kategoriseres og prioriteres. NIST SP 800-61 Rev. 3 (2025) knytter sin vejledning om hændelseshåndtering til disse CSF-resultater i stedet for den ældre livscyklus i fire faser. I praksis arbejder en SOC efter en lagdelt model: analytikere på Tier 1 foretager den første triage efter en runbook, Tier 2 undersøger eskalerede sager, og Tier 3 eller incident response-teamet håndterer bekræftede kompromitteringer.\n\nEn triagebeslutning følger typisk en fast rækkefølge. Analytikeren kontrollerer, at alarmen er udløst af reel telemetri, beriger den med kontekst (aktivets kritikalitet og ejer, brugerens rolle, nylig login-historik, threat intelligence om hashes, IP-adresser og domæner, relaterede alarmer på samme maskine eller identitet), fastlægger en disposition og tildeler en alvorlighed. Brugbare dispositioner skelner mellem sande positiver (ondsindet aktivitet), godartede sande positiver (reglen ramte den tilsigtede adfærd, men den var godkendt, fx en penetrationstest eller en administrators legitime PowerShell), falske positiver (reglen ramte noget, den ikke burde) og uafklarede. Det er vigtigt at registrere dispositionen præcist, for den er feedbacksignalet til justering af detektionsregler; blandes godartede sande positiver sammen med falske positiver, bliver regler svækket af de forkerte grunde.\n\nPrioritering kombinerer normalt alarmens alvorlighed med forretningspåvirkningen af det berørte aktiv, så resultatet er en matrix frem for en enkelt score. Samling af relaterede alarmer i én sag, deduplikering og korrelation pr. entitet mindsker mængden, før et menneske ser den; SOAR-playbooks automatiserer ofte berigelsen og lukningen af velkendte godartede mønstre. Nøgletal omfatter gennemsnitlig tid til kvittering, gennemsnitlig tid til triage, antal alarmer pr. analytiker og andelen af sande positiver pr. regel. Det kroniske problem er alarmtræthed: når de fleste alarmer er støj, lukker analytikerne dem efter mønster og overser den sjældne ægte, og derfor kan detection engineering og triagekvalitet ikke adskilles.\n\nTriage sætter også lovpligtige frister i gang. Efter NIS2 art. 23 skal en væsentlig eller vigtig enhed sende en tidlig varsling inden for 24 timer efter at have fået kendskab til en væsentlig hændelse og en hændelsesunderretning inden for 72 timer; efter databeskyttelsesforordningens art. 33, stk. 1, skal et brud på persondatasikkerheden anmeldes til tilsynsmyndigheden, i Danmark Datatilsynet, inden for 72 timer efter, at den dataansvarlige er blevet opmærksom på det. Det tidspunkt, hvor triagen skaber kendskab, skal derfor tidsstemples og dokumenteres. Triage adskiller sig fra trusselsjagt, der tager udgangspunkt i en hypotese frem for en alarm, og fra den egentlige undersøgelse, der rekonstruerer omfang og grundårsag, efter at sagen er eskaleret."},"edges":[{"type":"requires","to":"platform/alerting","confidence":"high","strength":"normal"},{"type":"part-of","to":"security/incident-response","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/threat-hunting","why":{"en":"Triage reacts to alarms that tools have already raised; hunting starts from a guess and searches for what raised no alarm.","da":"Triage reagerer på alarmer, værktøjerne allerede har rejst; trusselsjagt starter fra et gæt og leder efter det, der ikke gav alarm."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/false-positive","why":{"en":"Much of the work is spotting false alarms quickly, so real ones get the time they need.","da":"En stor del af arbejdet er hurtigt at genkende falske alarmer, så de reelle får den tid, de kræver."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/soc","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/incident-reporting","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/escalation-procedure","confidence":"high","strength":"normal"},{"type":"used-with","to":"ai/precision","why":{"en":"Precision measures how many alerts sent to triage were real, so low precision is felt directly as wasted triage time.","da":"Præcision måler, hvor mange af de alarmer, der sendes til triage, der var ægte, så lav præcision mærkes direkte som spildt tid i triagen."},"confidence":"medium","strength":"normal"}],"depth":2,"sources":[{"title":"NIST SP 800-61 Rev. 3 - Incident Response Recommendations and Considerations for Cybersecurity Risk Management","url":"https://doi.org/10.6028/NIST.SP.800-61r3","tier":"standard","publisher":"NIST"},{"title":"Cyber Security Fast Track - SIEM module","tier":"course-material"},{"title":"NIST CSWP 29 - The NIST Cybersecurity Framework (CSF) 2.0","url":"https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf","tier":"standard","publisher":"NIST"}],"draft":true}