triaging-security-incident

name	triaging-security-incident
description	Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.
domain	cybersecurity
subdomain	incident-response
tags	["incident-triage","NIST-800-61","SANS-PICERL","severity-classification","SOC-operations"]
mitre_attack	["T1486","T1490","T1070","T1078"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Triaging Security Incidents

When to Use

• A SIEM or EDR alert fires and requires human classification before escalation
• Multiple concurrent alerts arrive and the SOC must prioritize response order
• An end user reports suspicious activity and the incident needs initial categorization
• A threat intelligence feed matches an IOC observed in the environment

Do not use for routine vulnerability scanning results or compliance audit findings that do not represent active security incidents.

Prerequisites

• Access to SIEM platform (Splunk, Elastic, Microsoft Sentinel) with current alert data
• Incident classification taxonomy aligned to NIST SP 800-61r3 categories
• Predefined severity matrix mapping asset criticality to threat type
• Contact roster for escalation paths (Tier 1 through Tier 3 and CIRT)
• Asset inventory with business criticality ratings

Workflow

Step 1: Collect Initial Alert Data

Gather all available context from the triggering alert before making classification decisions:

• Alert source: Which detection system generated the alert (EDR, SIEM, IDS/IPS, firewall, user report)
• Timestamp: When the event occurred and when it was detected (dwell time gap)
• Affected assets: Hostnames, IP addresses, user accounts involved
• Alert fidelity: Historical true-positive rate for this detection rule
• Raw evidence: Log entries, packet captures, process execution chains

Example SIEM alert context:
Source:       CrowdStrike Falcon
Detection:    Suspicious PowerShell Execution (T1059.001)
Host:         WORKSTATION-FIN-042
User:         [e-mail]
Timestamp:    2025-11-15T14:23:17Z
Severity:     High (detection rule confidence: 92%)
Process:      powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA...
Parent:       outlook.exe (PID 4812)

Step 2: Classify the Incident Type

Map the alert to a standard incident category per NIST SP 800-61r3:

Category	Examples
Unauthorized Access	Compromised credentials, privilege escalation, IDOR
Denial of Service	Volumetric DDoS, application-layer flood, resource exhaustion
Malicious Code	Malware execution, ransomware detonation, cryptominer