Internship← SOC & SIEM learning pathSOC & SIEM · Module 5 of 10
Alert triage and investigation
Investigate alerts methodically.
📖 Key ideas
- Check alert details: who, what, where, when.
- Enrich with context: asset criticality, user role, threat intel reputation.
- Determine true positive, false positive or benign.
- Document findings in the ticket.
- Escalate according to severity and playbooks.
💡 Real-life example: Triage is an emergency ward doctor deciding who needs immediate care.
EnrichmentAdding context to an alert
True positiveReal malicious activity
EscalationPassing to higher tier
TicketRecord of an investigation