Overview
Severity rates how serious an alert is, prioritizing the SOC's limited attention. This lesson covers assessing alert severity.
Learning objectives
- Explain alert severity.
- Describe factors in assessing severity.
- Connect severity to prioritization.
Core concept
Severity is a rating of how serious an alert is — used to prioritize which alerts get attention first, since the SOC can't treat everything as urgent. Severity is judged from factors like the potential impact (what's at stake if real — critical asset? sensitive data? broad reach?), the confidence it's a true threat, and urgency (is harm ongoing or imminent?). Higher-severity alerts (high impact, high confidence, urgent) are handled first. Assessing severity — informed by the context gathered — lets the SOC focus its limited resources on what matters most, a core part of triage and effective monitoring.
How it works
Using the context gathered, the analyst assesses severity by weighing: impact — how important is the affected asset/data and how broad the potential effect? confidence — how likely is this a real threat vs a false positive? urgency — is damage happening now or imminent? An alert on a critical asset, with high confidence and active malicious behavior, is high severity and handled immediately; a low-confidence alert on a non-critical system is lower priority. SOCs often use severity levels (e.g. critical/high/medium/low), sometimes partly assigned by the SIEM and refined by the analyst. Severity drives prioritization — the order and urgency of response — ensuring limited analyst attention goes to the most serious alerts first. Misjudged severity means either dangerous delays or wasted effort.
Practical example
Two alerts arrive together. Alert A: high-confidence malicious activity on a critical server holding sensitive data, apparently active now. Alert B: a low-confidence anomaly on a non-critical test machine. Using context, the analyst rates A high severity (high impact, high confidence, urgent) and B low. They handle A first, escalating immediately, while B waits. Had they treated both equally, the serious threat (A) might have been delayed behind the minor one. Severity assessment prioritized limited attention onto what mattered most — the core purpose of rating severity.
Cybersecurity relevance
Severity drives prioritization — the SOC has limited attention and can't treat every alert as urgent, so rating seriousness (from impact, confidence, and urgency, informed by context) ensures the most serious alerts are handled first. It's a core part of triage and effective monitoring: misjudged severity means either dangerous delays (under-rating a real threat) or wasted effort (over-rating a minor one). Severity levels (critical/high/medium/low) may be partly SIEM-assigned and analyst-refined. It builds on context-gathering and feeds escalation decisions (later lesson). Sound severity assessment is essential to focusing the SOC's resources where they matter most.
Common mistakes
- Ignoring impact, confidence, or urgency when rating severity.
- Under-rating serious alerts (dangerous delay) or over-rating minor ones (wasted effort).
- Blindly trusting SIEM-assigned severity without analyst refinement from context.
Key takeaways
- Severity rates how serious an alert is, to prioritize the SOC's limited attention — judged from potential impact, confidence it's a true threat, and urgency.
- Higher-severity alerts (high impact/confidence/urgency) are handled first; context informs the assessment, and levels may be SIEM-assigned and analyst-refined.
- Severity drives prioritization; misjudging it causes dangerous delays or wasted effort — a core part of triage feeding escalation decisions.
Check your understanding
- What factors go into assessing an alert's severity?
- Why does severity drive prioritization, and what happens if it's misjudged?