All playbooks
SOC · SOC analysts and shift leads
First-pass alert triage
Turn an alert into an evidence-based disposition and a usable handoff.
Start with what the event actually shows, then decide its scope and urgency before assigning a disposition.
What this does not establish
- An alert title does not prove malicious intent.
- One matching event does not define the start or end of activity.
- A quiet search does not prove the required telemetry was present.
0 of 8 ticked
Selected step
FrameStep 1 of 8
Preserve the original alert and the rule version.
Record the alert and its source
- Keep event ID, source, detection ID and observed time.
- Note ingestion delay and the search window.