What it means
Triage turns a detection signal into an operational decision. An analyst determines what happened, which assets and identities are involved, whether the activity is expected, how trustworthy the evidence is, and whether the case should be closed, enriched, escalated, contained, or declared an incident.
How it works
Effective triage combines detection context with asset criticality, identity privilege, threat intelligence, recent changes, related events, and known benign patterns. Playbooks provide consistency, while analyst judgment handles ambiguity. High-risk cases should have clear time targets and immediate escalation paths.
An alert reports a new administrator login from an unusual location. Triage checks the account's role, device, authentication method, travel or maintenance records, session activity, and related changes. The result may be a benign approved action, a suspicious case requiring more investigation, or an active account-compromise incident.
Practical focus
- Validate the alert source and preserve supporting evidence
- Identify affected assets, identities, privileges, and business importance
- Use defined severity and escalation criteria
- Record the decision, rationale, and next action so outcomes can improve detection
Common mistakes
- Closing alerts based only on one familiar indicator
- Escalating every alert without adding useful context
- Optimizing for speed while ignoring evidence quality and recurrence
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: