Alert Triage and Investigation Workflow — Cybersecurity

Objective. Students follow a defined triage workflow to investigate a SIEM alert from initial notification through containment recommendation, producing a structured investigation ticket.

What Is Alert Triage?

When a SIEM generates an alert, it is a signal, not a verdict. Hundreds of alerts can fire in a single shift, and not every one represents a real attack. Alert triage is the disciplined process of examining each alert quickly and systematically so that genuine threats receive the right response and false positives are documented and closed without wasting escalation resources.

A structured triage workflow protects two things: the organization's systems and the analyst's credibility. Skipping steps leads to missed scope, wrong containment actions, or unnecessary escalations that erode trust with the incident response team.

The Five-Step Triage Workflow

Step 1 — Confirm the Alert

Before doing anything else, verify that the alert fired correctly. Pull the raw log events that triggered the rule. Ask: Does the data actually match what the rule is designed to detect? Check for sensor misconfiguration, time-zone offsets, or known data feed issues that could create phantom alerts. If the underlying log data supports the alert, proceed. If not, document it as a false positive and close with a note.

Step 2 — Scope the Affected Assets

Identify every host, user account, and network segment involved. In a lateral movement scenario, this means mapping each source IP, destination IP, and account name that appears in the alert and in pivot searches. Use the SIEM to expand the time window (look before and after the alert timestamp) and search for the same indicators on other hosts. Asset inventory and network diagrams help you understand whether an affected host is a workstation, a server, or a critical system such as a domain controller or database server. Scope determines urgency.

Step 3 — Gather Supporting Evidence

Evidence turns a suspicion into a supportable finding. From the SIEM, pivot on at least three data points:

Parent process and child process relationships — unusual parent-child chains (e.g., Word.exe spawning cmd.exe) suggest malicious execution.
User account history — look at logon patterns, times, source addresses, and whether the account has attempted access to systems it does not normally reach.
Network connections — outbound connections to rare external IPs, lateral connections on administrative ports (RDP 3389, SMB 445, WinRM 5985), or connections immediately following a successful logon all add context.

Document every search query and its result in the triage template. Evidence you cannot cite is evidence you cannot defend in a ticket or a legal proceeding.

Step 4 — Determine Impact

With scope and evidence in hand, assess what has actually happened or could happen. Consider confidentiality (was sensitive data accessed?), integrity (were files or configurations changed?), and availability (were services disrupted?). Classify the severity: informational, low, medium, high, or critical, using whatever scale your organization's playbook defines. Note whether the activity is ongoing or appears to have stopped.

Step 5 — Recommend an Action

Every triage ticket must end with a clear, actionable recommendation. Common options include:

Contain: isolate the host from the network, disable the compromised account, or block an IP at the firewall.
Escalate to Tier 2 / IR team: when the incident exceeds Tier 1 authority, involves a critical asset, or requires forensic acquisition.
Monitor: no immediate containment needed; set a watch rule and re-evaluate if the behavior recurs.
Close as false positive: document the reason so the detection rule can be tuned.

Your recommendation must be proportionate to the confirmed impact. An overly aggressive response (reimaging a server for a single failed login) causes operational disruption. An under-response (monitoring a confirmed credential compromise) allows the threat to persist.

Escalation Decisions

Not every true positive requires escalation. Tier 1 analysts handle alerts that can be remediated with predefined playbook steps and that do not involve critical assets or confirmed data exfiltration. Escalate when:

A critical or high-value asset is confirmed compromised.
The attack chain spans multiple hosts (active lateral movement).
Evidence suggests data staging or exfiltration.
Remediation requires actions outside Tier 1 authority (e.g., domain-wide password resets, legal holds).

When escalating, hand off the completed triage ticket — never make the Tier 2 analyst start from scratch.

Documentation and Safe Handling

Triage notes are potential evidence. Use factual, neutral language. Record timestamps in UTC to avoid ambiguity. Never modify or delete log data during an investigation, and never run unverified executable files from a suspect host on your analysis workstation. Work in an isolated analysis environment when opening potentially malicious attachments or scripts. If your organization has a chain-of-custody requirement, follow it from the moment you begin collecting evidence.

Key terms8

Alert triageThe structured process of evaluating a SIEM alert to determine whether it represents a real threat, its scope, and the appropriate response.

True positiveAn alert that correctly identifies malicious or unauthorized activity that actually occurred.

False positiveAn alert that fires on benign activity; the rule triggered but no actual threat exists.

Lateral movementAttacker technique of moving from an initial compromised host to other systems within the network, often using stolen credentials or exploitation of trust relationships.

PivotThe act of using one piece of evidence (such as an IP address or username) as a search term to find related events across the SIEM dataset.

EscalationFormally transferring an incident to a higher-tier analyst or incident response team because the situation exceeds the current tier's scope of authority or technical capability.

ContainmentActions taken to limit the spread or impact of a confirmed incident, such as isolating a host, disabling an account, or blocking a network connection.

ScopeThe full set of assets, accounts, and network segments confirmed or suspected to be involved in an incident.

In class: Workflow walkthrough: instructor demonstrates triage of a pre-staged brute-force alert using a five-step process (confirm the alert, scope affected assets, gather supporting evidence, determine impact, recommend action); students take annotated notes and complete a blank triage template alongside the demo. · Guided investigation: students receive a pre-staged alert (lateral movement scenario with failed and successful logins across multiple hosts) and independently complete the five-step triage, using SIEM search to gather pivot evidence (parent process, user account history, network connections); findings documented in the triage template. · Escalation decision exercise: students receive three completed triage summaries (one true positive requiring escalation, one true positive manageable at Tier 1, one false positive); they must classify each and write a two-sentence justification for each decision.
Materials: SIEM instance with pre-staged multi-event scenario dataset, triage template (provided), investigation ticket template (modeled on a simple ticketing system form), CySA+ study guide (incident response chapter)
Check: Instructor reviews completed triage ticket for the guided investigation: all five steps present, at least three supporting evidence items cited from SIEM searches, and a clear containment recommendation. Pass = all five steps completed with cited evidence.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.