SOC operations and alert triage

The alert queue

An alert queue is the list of security alerts waiting to be reviewed. Alerts might involve repeated failed logins, unusual sign-ins, suspicious downloads or malware detections.

Analysts need to decide which alerts require immediate attention. Tool severity is useful, but the affected system, user, surrounding activity and potential impact also matter.

What triage means

Triage is the initial check used to sort and prioritise alerts. It is not necessarily a complete investigation. The aim is to decide what should happen next.

Alert trigger

What triggered the alert, and which device or account is involved?

User context

Does the activity fit the user’s role and normal behaviour?

Supporting evidence

Is there evidence of a threat, or a reasonable legitimate explanation?

Urgency and escalation

How urgent is it, and does it need escalation?

Understanding alert outcomes

Different teams may use different labels. These three distinctions are useful when documenting a decision.

False positive

The detection incorrectly identified the activity as matching the threat or condition it was intended to detect. For example, a legitimate file was incorrectly identified as malware.

Benign true positive

The detection correctly identified the activity, but the context was legitimate. For example, an unusual-location sign-in matched the rule because the user was travelling.

Malicious true positive

The detection identified genuine threatening activity, such as an attacker using a compromised account.

Response agreements and escalation

A Service Level Agreement (SLA) usually describes commitments to a client, such as how quickly a critical alert will be reviewed. An Operational Level Agreement (OLA) coordinates responsibilities between internal teams.

The exact timings depend on the organisation. An analyst should understand the relevant agreements and escalation procedures rather than assume one response time applies everywhere.

Don’t let SOC levels limit your learning

SOCs often organise work into L1, L2 and L3 responsibilities. These commonly include alert triage, deeper investigation, threat hunting and detection engineering.

However, the levels don’t always indicate how difficult a task is. An L1 triage decision can be difficult, while an L3 task, such as writing a basic detection rule, can be straightforward.

As a beginner, you don’t need to wait until you reach a particular level to start learning threat hunting, alert tuning or detection rule writing. Don’t let these labels limit what you learn or practise. Focus on building your skills through practical work.

Containment and remediation

Containment limits further harm and stops the threat from spreading. Remediation removes the threat and addresses the underlying problem.

For an infected laptop, containment might involve isolating it from the network. Remediation might involve removing malware and persistence, resetting affected credentials, patching the cause and restoring a clean device.

Throughout the investigation, record the evidence, the decision and any remaining uncertainty. This makes the handover useful to the next analyst or response team.