A
Why triage is a craft
Without clear criteria, everything becomes “urgent”. Junior analysts open every ticket at the same pace, the queue piles up, and real incidents disappear in noise.
This guide offers a simple matrix and field guardrails. It does not lock you to a specific SIEM: the point is operational discipline.
Severity matrix (example)
| Level | Criteria | Triage SLA |
|---|---|---|
| P1 | Active exfiltration, domain admin compromise, ransomware in progress | 15 min |
| P2 | Lateral movement, C2 beaconing, suspicious privileged account | 30 min |
| P3 | Single-host malware already blocked, stopped attempt, phishing not clicked | 4 h |
First five minutes
- Rule out obvious false positives (lab traffic, planned scans, known service accounts).
- Capture context: host, user, source/destination, timestamp.
- Assign P1 / P2 / P3 with the matrix above.
- Write a one-line decision in the ticket.
Escalation
| Situation | Action |
|---|---|
| Confirmed P1 | Escalate immediately (SOC lead / incident commander) |
| P2 with doubt | Contain the host if possible, then escalate within 30 min |
| Clear P3 | Standard queue, no page |
Common traps
- Classifying everything as P1 “to be safe”
- Waiting for 100% certainty before containing
- Ignoring service accounts in scope
- Never closing P3s: ticket debt kills morale
Link to DailyOps
This aligns with the SOC: First 30 Days lab and the incident playbook. Use it as a shift checklist, not slide-deck theory.