SOC Alert Triage

Alert analysis and prioritization:

• Alert enrichment with context
• Risk scoring
• Event correlation
• Classification (malware, intrusion, exfil)
• Investigation playbook selection
• Recommended actions

Required Context

1. Alert: Details from SIEM/EDR
2. Context: Asset info, user info, recent activity
3. Priority: Urgency level

Output

• Risk score (CRITICAL/HIGH/MEDIUM/LOW)
• Correlation with related events
• Investigation steps
• Recommended actions

Example

/triage
Alert: PowerShell encoded command detected
Host: WORKSTATION-05
User: jsmith