Overview
Triage is assessing alerts to decide what they mean and what to do; it starts with gathering context. This lesson covers alert context.
Learning objectives
- Define alert triage.
- Explain the role of context in triage.
- Identify what context to gather.
Core concept
Alert triage is the process of assessing each alert to determine its validity, severity, and required action — the SOC's front-line filtering of what the SIEM surfaces. It begins with gathering context: an alert alone (e.g. "suspicious login") means little until placed in context — who/what is involved, what else was happening around it, whether it's expected or anomalous, and its potential impact. Context turns a raw alert into an understood situation, letting the analyst judge whether it's a real threat, a false positive, or benign. Gathering context (via SIEM queries, asset info, enrichment) is the essential first step of triage.
How it works
When an alert arrives, the analyst triages it by first building context. Using SIEM queries (module 5) and available information, they ask: what asset/user is involved and how important is it? What else did that user/host/IP do around the alert time (correlated activity)? Is this behavior expected (a known process, a legitimate admin action) or genuinely anomalous? What's the potential impact if it's real? This context — assembled from logs, asset inventories, and enrichment — transforms the bare alert into an understood situation. Only with context can the analyst assess severity, judge false positive likelihood, and decide on action. Skipping context leads to misjudged alerts (dismissing real threats or over-reacting to benign ones). Context-gathering is the foundation of sound triage.
Practical example
An analyst receives an alert: "unusual login for user X." Alone, it's ambiguous. The analyst gathers context: user X is a standard user (asset info), the login came from an unfamiliar location at an odd hour, and around the same time the account accessed several sensitive resources (correlated activity via SIEM query). This context reframes the alert as a likely account compromise with real impact — very different from, say, a routine login flagged by an over-sensitive rule. The context turned an ambiguous alert into an understood, actionable situation — the essential first step of triage.
Cybersecurity relevance
Context is the foundation of sound triage — the SOC's front-line assessment of alerts. A bare alert is ambiguous; context (who/what is involved, surrounding activity, expected vs anomalous, potential impact) turns it into an understood situation, enabling correct judgments of severity, false-positive likelihood, and action. It's gathered via SIEM queries (module 5), asset info, and enrichment (later lesson). Skipping context causes misjudged alerts — dismissing real threats or over-reacting to benign ones. Context-gathering is the essential first step of triage and underpins the whole triage workflow (severity, false positives, enrichment, escalation) built in this module.
Common mistakes
- Judging an alert without context, leading to wrong verdicts.
- Not checking asset importance or surrounding activity when assessing an alert.
- Assuming an alert is real (or false) without gathering the facts.
Key takeaways
- Alert triage assesses each alert's validity, severity, and required action — the SOC's front-line filtering of SIEM output.
- It starts with gathering context: who/what is involved, surrounding activity, expected vs anomalous, and potential impact — turning a bare alert into an understood situation.
- Context (via SIEM queries, asset info, enrichment) enables correct severity, false-positive, and action judgments; skipping it causes misjudged alerts.
Check your understanding
- What is alert triage, and why is context essential to it?
- What kinds of context should an analyst gather for an alert?