Alert triage is the systematic process of evaluating, prioritizing, and routing security alerts to determine which require investigation and response. SOC analysts perform triage as the first step in alert handling, rapidly assessing each alert's validity, severity, and potential impact to allocate response resources effectively. A well-designed triage process prevents alert fatigue, ensures critical threats receive immediate attention, and filters false positives before they consume analyst time.
Triage follows a structured evaluation workflow. Initial assessment determines whether the alert is a true positive (real threat), false positive (benign activity matching a detection rule), or benign true positive (real activity that is authorized). Analysts evaluate context including the affected asset's criticality, the user's role and normal behavior, threat intelligence enrichment, and correlated alerts from other sources. Priority assignment uses a matrix combining alert severity with asset criticality and threat intelligence context. High-priority alerts receive immediate investigation, medium-priority alerts are queued for timely review, and low-priority alerts may be batch-processed or auto-closed with documentation. Triage decisions and rationale are recorded in the ticketing system to support metrics tracking and quality assurance. Automation assists triage by pre-enriching alerts with contextual data, applying known false positive filters, and auto-closing alerts matching previously investigated patterns.
SOC teams face thousands to tens of thousands of alerts daily. Without effective triage, analysts waste time on false positives while genuine threats queue unaddressed. Alert fatigue -- the desensitization that occurs when analysts are overwhelmed with alerts -- is a leading cause of missed detections. A disciplined triage process ensures that the most dangerous threats receive priority attention, that analyst cognitive load is managed, and that triage quality is measurable and improvable over time.
CDA builds alert triage processes as part of TID domain C-BUILD missions. Our approach emphasizes automation-assisted triage where enrichment and known false positive filtering happen before an analyst sees the alert. CDA's SOC design missions include triage playbooks for each alert category, escalation criteria, and quality metrics. Our C-HARDEN campaigns validate triage effectiveness by measuring detection-to-investigation times during adversary simulations.