alert-triage

Alert Triage Playbook

Frameworks: MITRE ATT&CK v16, NIST SP 800-61 Rev 2 Role: SOC Analyst Time: 10-20 min per alert Output: Alert disposition (TP/BTP/FP), priority assignment (P1-P4), escalation decision

---

1. When to Use

If a target is provided via arguments, focus the review on: $ARGUMENTS

Invoke this skill when any of the following conditions are met:

• New alert received -- A SIEM, EDR, or security tool has generated an alert that requires analyst investigation.
• Alert queue prioritization -- Multiple alerts are pending and the analyst needs to determine the investigation order.
• True positive determination -- The analyst needs a structured methodology to determine whether an alert represents a genuine threat, benign activity, or a false positive.
• Escalation decision -- The analyst needs criteria to determine whether an alert should be escalated to Tier 2, the IR team, or management.
• Triage documentation -- The analyst needs to produce a consistent, auditable record of triage decisions.

Do not use when: The alert has already been confirmed as a true positive and requires full incident response (use ir-playbook), the task is writing new detection rules (use detection-engineering or siem-rules), or the task is forensic analysis of a confirmed compromise (use log-analysis for initial investigation).

---

2. Context the Agent Needs

Before beginning triage, gather or confirm:

• Alert details: Rule name, severity, timestamp, source system (SIEM, EDR, IDS, cloud security).
• Alert data: The raw event(s) that triggered the alert -- including all available fields (source IP, destination IP, username, hostname, process name, command line, file hash, URL).
• ATT&CK mapping: If the alert rule maps to a MITRE ATT&CK technique, note the technique ID.
• Asset context: What is the affected asset? (Server, workstation, cloud instance, network device.) What is its business criticality? (Revenue-generating, customer-facing, development, test.)
• User context: Who is the associated user? (Role, department, normal working hours, recent activity patterns.)
• Historical context: Has this alert fired before? What was the previous disposition? Has this user or host generated related alerts recently?
• Threat intelligence: Do any indicators in the alert (IPs, domains, hashes) appear in threat intelligence feeds?