domains / families / security / triaging-security-incident-with-ir-playbook

triaging-security-incident-with-ir-playbook

separate

Classifies and prioritizes security incidents using structured IR

When to use

• New security alert received from SIEM, EDR, or other detection sources
• SOC analyst needs to determine if an alert is a true positive requiring response
• Incident needs severity classification and team assignment
• Multiple concurrent incidents require prioritization
• Automated triage rules need validation or tuning

Skill page

Source