Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.
Instrucciones de origen · Vista previa de solo lectura
name
triaging-security-incident-with-ir-playbook
description
Classify and prioritize security incidents using structured IR playbooks to determine severity, assign response teams, and initiate appropriate response procedures.
Enrichment context, not just reputation, drives severity: a "clean" VirusTotal/AbuseIPDB result does not downgrade an alert — newly registered C2 and fast-flux infrastructure often have zero detections. Validate against asset criticality (CMDB), data classification, and whether the threat is active vs historical before assigning P1-P4.
The most-missed triage error is closing the alert in isolation: before calling true/false positive, pivot — same src/dest IP, same user, same hash across the last 30 days. A single brute-force or "quarantined malware" alert is frequently one node of a broader intrusion (lateral movement, persistence) that single-alert triage buries.
Confirm the alert maps to the right playbook: signature names lie. Decode the payload, resolve the MITRE technique, and verify the trigger conditions actually match before launching a playbook — a mis-categorized incident routes to the wrong team and burns SLA.
Cross-corroborate the severity inputs: verify asset criticality from CMDB (not the analyst's guess), confirm the account is actually privileged, and validate "active threat" with EDR process state rather than the alert timestamp alone.
FP tuning: track each detection rule's historical true-positive rate and suppress/auto-close chronic noisemakers (scanner traffic, known admin tooling, sanctioned data flows) so analysts don't fatigue and miss the real P1. Don't auto-close on a low score until enrichment and historical correlation agree.
Prerequisites
SIEM platform with alert correlation (Splunk, Elastic, QRadar, Sentinel)
Alert correctly identifying a real security incident
False Positive
Alert incorrectly flagging benign activity as malicious
Severity Classification
Ranking incident priority based on impact and urgency
Playbook Selection
Choosing the appropriate response procedure based on incident type
IOC Enrichment
Adding context to indicators from threat intelligence sources
Escalation Threshold
Criteria triggering escalation to higher severity or management
Triage SLA
Time target for initial assessment (typically 15-30 min for critical)
Tools & Systems
Tool
Purpose
Splunk/Elastic/QRadar
SIEM alert correlation and querying
TheHive/SIRP
Incident case management and playbook tracking
VirusTotal/AbuseIPDB
IOC reputation and enrichment
PagerDuty/OpsGenie
On-call management and alerting
MITRE ATT&CK
Technique classification and mapping
Cortex XSOAR
SOAR platform for automated triage workflows
Common Scenarios
Brute Force Alert: Multiple failed logins from single IP. Enrich IP reputation, check geo-location, verify if account was compromised, assign P3 if unsuccessful.
Malware Detection on Endpoint: AV/EDR quarantined malware. Verify quarantine success, check for lateral movement, assign P2 if persistence detected.
Suspicious Outbound Traffic: Large data transfer to unknown external IP. Check if known cloud service, verify data classification, assign P1 if exfiltration confirmed.
Phishing Email Reported: User reports suspicious email. Extract IOCs, check if others received it, assign P2 if credentials were entered.
Privilege Escalation: User gained admin rights unexpectedly. Verify if authorized change, check for exploitation, assign P1 if unauthorized.
Output Format
Triage decision document with severity justification
Incident ticket with assigned playbook and team
IOC enrichment summary attached to case
Escalation notification to appropriate stakeholders
