triaging-security-incident

name	triaging-security-incident
description	Performs initial triage of security incidents to determine severity, scope, and required response actions using the NIST SP 800-61r3 and SANS PICERL frameworks. Classifies incidents by type, assigns priority based on business impact, and routes to appropriate response teams. Activates for requests involving incident triage, security alert classification, severity assessment, incident prioritization, or initial incident analysis.
domain	cybersecurity
subdomain	incident-response
tags	["incident-triage","NIST-800-61","SANS-PICERL","severity-classification","SOC-operations"]
mitre_attack	["T1190","T1566","T1078","T1059"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"]
nist_csf	["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"]

Triaging Security Incidents

When to Use

• A SIEM or EDR alert fires and requires human classification before escalation
• Multiple concurrent alerts arrive and the SOC must prioritize response order
• An end user reports suspicious activity and the incident needs initial categorization
• A threat intelligence feed matches an IOC observed in the environment

Do not use for routine vulnerability scanning results or compliance audit findings that do not represent active security incidents.

Prerequisites

• Access to SIEM platform (Splunk, Elastic, Microsoft Sentinel) with current alert data
• Incident classification taxonomy aligned to NIST SP 800-61r3 categories
• Predefined severity matrix mapping asset criticality to threat type
• Contact roster for escalation paths (Tier 1 through Tier 3 and CIRT)
• Asset inventory with business criticality ratings

Workflow

Step 1: Collect Initial Alert Data

Gather all available context from the triggering alert before making classification decisions:

• Alert source: Which detection system generated the alert (EDR, SIEM, IDS/IPS, firewall, user report)
• Timestamp: When the event occurred and when it was detected (dwell time gap)
• Affected assets: Hostnames, IP addresses, user accounts involved
• Alert fidelity: Historical true-positive rate for this detection rule
• Raw evidence: Log entries, packet captures, process execution chains

Example SIEM alert context:
Source:       CrowdStrike Falcon
Detection:    Suspicious PowerShell Execution (T1059.001)
Host:         WORKSTATION-FIN-042
User:         [e-mail]
Timestamp:    2025-11-15T14:23:17Z
Severity:     High (detection rule confidence: 92%)
Process:      powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA...
Parent:       outlook.exe (PID 4812)

Step 2: Classify the Incident Type

Map the alert to a standard incident category per NIST SP 800-61r3:

Category	Examples
Unauthorized Access	Compromised credentials, privilege escalation, IDOR
Denial of Service	Volumetric DDoS, application-layer flood, resource exhaustion
Malicious Code	Malware execution, ransomware detonation, cryptominer