domains / families / security / triaging-security-alerts-in-splunk

triaging-security-alerts-in-splunk

separate

'Triages security alerts in Splunk Enterprise Security by classifying

When to use

• SOC Tier 1 analysts need to process the Incident Review queue in Splunk Enterprise Security (ES)
• Notable events require rapid severity classification and initial investigation before escalation
• Alert volume exceeds capacity and analysts need a systematic triage methodology
• Management requests metrics on alert disposition (true positive, false positive, benign)

When not to use

• deep forensic investigation

Skill page

Source