Alert triage

In frameworks, triage sits at the boundary between detection and response. NIST CSF 2.0 separates the analysis of adverse events in the Detect function (DE.AE, including DE.AE-08, declaring an incident when events meet defined criteria) from incident management in Respond, where RS.MA-02 requires that incident reports are triaged and validated and RS.MA-03 that incidents are categorised and prioritised. NIST SP 800-61 Rev. 3 (2025) maps its incident response guidance onto these CSF outcomes instead of the older four-phase lifecycle. In practice a SOC works through a tiered model: Tier 1 analysts perform initial triage against a runbook, Tier 2 investigates escalated cases, and Tier 3 or incident response handles confirmed compromises.

A triage decision typically follows a fixed sequence. The analyst validates that the alert fired on real telemetry, enriches it with context (asset criticality and owner, user role, recent authentication history, threat intelligence on hashes, IPs and domains, related alerts on the same host or identity), determines a disposition and assigns a severity. Useful dispositions distinguish true positives (malicious activity), benign true positives (the rule matched the intended behaviour but it was authorised, such as a penetration test or an administrator's legitimate PowerShell), false positives (the rule matched something it should not have) and undetermined. Recording the disposition precisely matters, because it is the feedback signal for tuning detection rules; lumping benign true positives in with false positives leads to rules being weakened for the wrong reason.

Prioritisation usually combines the alert's severity with the business impact of the affected asset, giving a matrix rather than a single score. Grouping related alerts into one case, deduplication, and correlation by entity reduce volume before a human sees it; SOAR playbooks commonly automate enrichment and the closure of well-understood benign patterns. Metrics include mean time to acknowledge, mean time to triage, alert volume per analyst and the true-positive rate per rule. The chronic failure mode is alert fatigue: when most alerts are noise, analysts close them by pattern and miss the rare real one, which is why detection engineering and triage quality are inseparable.

Triage also drives regulatory clocks. Under NIS2 Art. 23, an essential or important entity must send an early warning within 24 hours of becoming aware of a significant incident and an incident notification within 72 hours; under GDPR Art. 33(1), a personal data breach must be notified to the supervisory authority, in Denmark Datatilsynet, within 72 hours of the controller becoming aware of it. The point at which triage establishes awareness therefore needs to be timestamped and documented. Triage differs from threat hunting, which starts from a hypothesis rather than an alert, and from full investigation, which reconstructs scope and root cause after the case has been escalated.