domains / families / security / triaging-security-incident

triaging-security-incident

separate

'Performs initial triage of security incidents using the NIST SP

When to use

• A SIEM or EDR alert fires and requires human classification before escalation
• Multiple concurrent alerts arrive and the SOC must prioritize response order
• An end user reports suspicious activity and the incident needs initial categorization
• A threat intelligence feed matches an IOC observed in the environment

When not to use

• Routine vulnerability scanning results
• Compliance audit findings

Skill page

Source