| name | triaging-security-incident |
| description | Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM/EDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization. |
| domain | cybersecurity |
| subdomain | incident-response |
| tags | ["incident-triage","NIST-800-61","SANS-PICERL","severity-classification","SOC-operations"] |
| mitre_attack | ["T1486","T1490","T1070","T1078"] |
| version | 1.0.0 |
| author | mahipal |
| license | Apache-2.0 |
| d3fend_techniques | ["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Content Format Conversion","File Content Analysis"] |
| nist_csf | ["RS.MA-01","RS.MA-02","RS.AN-03","RC.RP-01"] |
Triaging Security Incidents
When to Use
- A SIEM or EDR alert fires and requires human classification before escalation
- Multiple concurrent alerts arrive and the SOC must prioritize response order
- An end user reports suspicious activity and the incident needs initial categorization
- A threat intelligence feed matches an IOC observed in the environment
Do not use for routine vulnerability scanning results or compliance audit findings that do not represent active security incidents.
Prerequisites
- Access to SIEM platform (Splunk, Elastic, Microsoft Sentinel) with current alert data
- Incident classification taxonomy aligned to NIST SP 800-61r3 categories
- Predefined severity matrix mapping asset criticality to threat type
- Contact roster for escalation paths (Tier 1 through Tier 3 and CIRT)
- Asset inventory with business criticality ratings
Workflow
Step 1: Collect Initial Alert Data
Gather all available context from the triggering alert before making classification decisions:
- Alert source: Which detection system generated the alert (EDR, SIEM, IDS/IPS, firewall, user report)
- Timestamp: When the event occurred and when it was detected (dwell time gap)
- Affected assets: Hostnames, IP addresses, user accounts involved
- Alert fidelity: Historical true-positive rate for this detection rule
- Raw evidence: Log entries, packet captures, process execution chains
Example SIEM alert context:
Source: CrowdStrike Falcon
Detection: Suspicious PowerShell Execution (T1059.001)
Host: WORKSTATION-FIN-042
User: jsmith@corp.example.com
Timestamp: 2025-11-15T14:23:17Z
Severity: High (detection rule confidence: 92%)
Process: powershell.exe -enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoA...
Parent: outlook.exe (PID 4812)
Step 2: Classify the Incident Type
Map the alert to a standard incident category per NIST SP 800-61r3:
| Category | Examples |
|---|
| Unauthorized Access | Compromised credentials, privilege escalation, IDOR |
| Denial of Service | Volumetric DDoS, application-layer flood, resource exhaustion |
| Malicious Code | Malware execution, ransomware detonation, cryptominer |
|
