Learn
LoginRegister
← All playbooks

Professional workflow · SOC

SOC alert triage

Objective

Triage SIEM/EDR alerts into true positives, false positives, and escalations with consistent ticket quality.

Authorized scope

Production telemetry within SOC policy. No offensive probing of customer systems beyond approved response actions.

Prerequisites

  • SOC Analyst course or equivalent
  • SIEM access + runbooks
  • Escalation matrix
Course →Roadmap L16 →

Step-by-step workflow

  1. Step 01

    Queue intake

    • Sort by severity / SLA
    • Claim alert; note start time
    • Check for related open cases

  2. Step 02

    Enrich

    • Pull user/host context
    • Check threat intel / IOC lists
    • Map to MITRE technique if known

  3. Step 03

    Decide

    • FP → tune note + close with reason
    • TP benign → document + monitor
    • TP malicious → escalate to IR with package

  4. Step 04

    Ticket quality

    • Write what / when / who / evidence links
    • Record next action owner
    • Meet SLA timestamps

Expected evidence

  • Alert ID + raw event samples
  • Enrichment notes
  • Disposition + rationale
  • Escalation package (if any)

Checklist

  • SLA acknowledged
  • No alert closed without disposition
  • Related alerts linked
  • Tuning feedback filed for noisy rules

Reporting template

Alert ID: […]
Disposition: TP / FP / Benign
Summary: […]
Entities: user / host / IP
MITRE: […]
Evidence: […]
Next action: […]

Remediation

  • Tune noisy detections with detection engineering
  • Add context fields to reduce manual enrichment
  • Feed TTPs into hunting backlog

Related tools