Detection and triage
🎯You'll be able to
Decide whether an alert is an incident, how serious it is, and what to find out first, while keeping a written log.
🏠The everyday picture
In a hospital emergency department, a nurse quickly decides who needs a doctor now and who can wait, and writes down what was seen and when.
📘What it really is
- Triage questions:
- Is it real, or a false alarm? Check the evidence behind the alert.
- What is affected: which accounts, systems and data?
- Is it still happening?
-
How serious is it, using the plan's severity levels?
-
Start the log at once: every action with the time (UTC and local), who did it and why. Memory fades within hours, and the log becomes evidence.
-
Correlate: a takeover alert plus bulk record viewing plus an admin grant by the same account tells one story.
-
Don't alert the intruder: avoid emailing the compromised account about it, or announcing the investigation on systems they may read.
-
Escalate early: when in doubt, raise it to the incident lead. Downgrading later is easy; lost hours aren't recoverable.
📝A worked example
Input: the alerts from CY6 for account S04: ACCOUNT_TAKEOVER_SUSPECTED, BULK_ACCESS and PRIVILEGE_CHANGE (self-grant at night).
Steps:
- Check the evidence: seven failures from
203.0.113.77, then a success at 21:40 UTC (03:10 IST) on 30 October. - Check the scope: 260 patient records viewed, then admin rights granted to S04 by S04 at 21:52 UTC.
- Rate it: personal data accessed and rights raised, so high. Escalate to the incident lead and start the log.
Expected output: a triage note saying "confirmed incident, high severity, account S04, about 260 patient records viewed, admin rights self-granted, started 21:40 UTC".
🌍Where it's used
- SOC analysts triage dozens of alerts a shift.
- Banks triage suspected fraud within minutes.
- On-call engineers use the same questions for outages.
📝Case scenario
An analyst saw a takeover alert and closed it as "probably a typo" without looking at what the account did next. A week later, the same account was found to have exported customer lists that night. The fix was a triage checklist that always looks at the next hour of activity.
🖱️Try it
Read the kit's reports/alerts.json after running the detection solution, and group the alerts into separate stories. Success: you
can say which alerts belong to the S04 incident and which belong to other events.
⚠️Common mistakes
- No written log. Sign: "we'll write it up later". Fix: log from the first minute.
- Judging an alert alone. Sign: one alert closed without context. Fix: check what else the account or address did.
- Telling the account owner by email. Sign: a warning sent to the compromised mailbox. Fix: contact them another way.
🛠️For your project
Your capstone playbook starts with a triage checklist and a log template.
✅Quick check
Why start a written log at the first minute?
Show the answer
Details fade quickly, and the log is needed for decisions, reports and evidence.
What turns three separate alerts into one incident?
Show the answer
They involve the same account or system and fit one sequence in time.