Security Event Triage

  1. Prioritization Frameworks and Models
    1. Severity Classification
      1. Critical
        1. Immediate Threats to Business Operations
          1. Active Data Breaches
          2. High
            1. Significant Security Risks
              1. Potential for Major Impact
              2. Medium
                1. Moderate Impact Events
                  1. Contained Threats
                  2. Low
                    1. Minor or Contained Events
                      1. Limited Impact Potential
                      2. Informational
                        1. Non-Actionable Data
                          1. Awareness Purposes
                        2. Impact Assessment
                          1. Business Impact
                            1. Financial Loss Potential
                              1. Reputational Damage Risk
                                1. Regulatory Compliance Issues
                                2. Data Impact
                                  1. Data Breach Potential
                                    1. Data Integrity Concerns
                                      1. Confidentiality Risks
                                      2. Operational Impact
                                        1. Service Disruption
                                          1. Productivity Loss
                                            1. System Availability
                                          2. Urgency Determination
                                            1. Active vs. Historical Threat
                                              1. Ongoing Attacks
                                                1. Past Events Requiring Review
                                                2. Scope of Compromise
                                                  1. Number of Affected Systems
                                                    1. Lateral Movement Potential
                                                      1. Network Segment Impact
                                                      2. Attacker Sophistication
                                                        1. Use of Advanced Techniques
                                                          1. Evidence of Targeted Attacks
                                                            1. Tool and Method Analysis
                                                          2. Using Industry Frameworks
                                                            1. MITRE ATT&CK Framework
                                                              1. Mapping Alerts to Tactics, Techniques, and Procedures (TTPs)
                                                                1. Identifying Gaps in Detection
                                                                  1. Attack Path Analysis
                                                                  2. The Cyber Kill Chain
                                                                    1. Stages of Attack Progression
                                                                      1. Disruption Points
                                                                        1. Prevention Opportunities
                                                                        2. The Diamond Model of Intrusion Analysis
                                                                          1. Adversary Analysis
                                                                            1. Capability Assessment
                                                                              1. Infrastructure Mapping
                                                                                1. Victim Profiling

                                                                            Previous

                                                                            5. Tools of the Triage Analyst

                                                                            Go to top

                                                                            Next

                                                                            7. Common Alert Types and Triage Approaches