Security Event Triage

  1. Documentation and Communication
    1. Writing Effective Triage Summaries
      1. The "Who, What, When, Where, Why"
        1. Stakeholder Identification
          1. Event Description
            1. Timeline Construction
              1. Location and System Details
                1. Root Cause Analysis
                2. Key Findings and IOCs
                  1. Summary of Evidence
                    1. List of Relevant IOCs
                      1. Supporting Data Points
                    2. Creating and Managing Tickets
                      1. Standardized Ticketing Formats
                        1. Required Fields
                          1. Consistent Terminology
                            1. Template Usage
                            2. Ticket Lifecycle Management
                              1. Status Updates
                                1. Progress Tracking
                                  1. Closure Procedures
                                2. Escalation Procedures
                                  1. Defining Escalation Paths
                                    1. Tiered Response Structure
                                      1. Escalation Triggers
                                        1. Authority Levels
                                        2. Communication with Tier 2/3 Analysts
                                          1. Information Handover
                                            1. Collaboration Tools
                                              1. Knowledge Transfer
                                              2. Handoff Protocols
                                                1. Documentation Requirements
                                                  1. Confirmation of Receipt
                                                    1. Transition Procedures
                                                  2. Feedback Loops
                                                    1. Tuning Security Tools to Reduce False Positives
                                                      1. Rule Adjustment
                                                        1. Threshold Modification
                                                          1. Whitelisting and Blacklisting
                                                          2. Improving Detection Rules
                                                            1. Rule Testing and Validation
                                                              1. Incorporating Analyst Feedback
                                                                1. Performance Metrics
                                                                2. Documenting Lessons Learned
                                                                  1. Post-Incident Reviews
                                                                    1. Process Updates
                                                                      1. Knowledge Base Maintenance

                                                                  Previous

                                                                  7. Common Alert Types and Triage Approaches

                                                                  Go to top

                                                                  Next

                                                                  9. Developing Triage Expertise