Alert triage
noun · also Triage, Incident triage · Microsoft Learn: Prioritize incidents in the Microsoft Defender portal
The first quick assessment of a security alert or incident: is it real, how serious is it, and what needs to happen next and how soon.
The word comes from emergency medicine, where triage decides which patient is treated first. In a SOC, triage is the first look at an alert or incident. The analyst does not try to understand everything yet. They check enough evidence to classify it, judge its severity and scope, and decide whether to close it, keep watching it or escalate it for containment and a full investigation.
Good triage is consistent: the same questions, in the same order, with notes that explain the decision. Tools help by grouping related alerts into incidents and scoring them, but the decision and its reasons belong to the analyst.
Example
An alert reports a sign-in from an unfamiliar country. During triage, the analyst checks the user's recent sign-ins, sees the same device and a travel booking in the calendar, finds no other alerts for the account, and closes it as expected activity with a note. Ten minutes, one decision, one clear record.
Why it matters for a SOC analyst
Triage is most of the work in an entry-level SOC role. Doing it well means real threats are escalated quickly, noise is closed with reasons that help tune detections, and nobody has to repeat your work later.
Related terms
- Security operations center
The team, processes and tools that monitor an organization around the clock, investigate alerts and coordinate the response to incidents.
- True positive
An alert that correctly flags real malicious activity: the detection worked and the threat is genuine, so it needs a response.
- False positive
An alert that fires on activity that is not actually malicious, because the detection logic matched something legitimate.
- Incident response
The organized process of detecting, analyzing, containing, eradicating and recovering from a security incident, then learning from it.
- SIEM
A platform that collects logs from across an organization, correlates them and raises alerts, giving the SOC one place to investigate.