◇ OpenCyber Academy
Technical · Chapter 5 · English

Chapter 5 — Triage and prioritisation

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 5 — Triage and prioritisation

Lesson map

Lesson 05 published. Map, example, EX017.

flowchart TD
  N0["Learning outcomes"]
  N1["5.1 What triage is"]
  N2["5.2 Two inputs"]
  N3["Lab — ranking alerts"]
  N4["5.3 Lab result"]
  N5["5.4 Escalation"]
  N6["5.5 Recording"]
  N7["5.6 Asset list"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX017"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["5.1 What triage is"]
  N2["5.2 Two inputs"]
  N3["Lab — ranking alerts"]
  N4["5.3 Lab result"]
  N5["5.4 Escalation"]
  N6["5.5 Recording"]
  N7["5.6 Asset list"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX017"]

[Learning outcomes]
    |
    v
[5.1 What triage is]
    |
    v
[5.2 Two inputs]
    |
    v
[Lab — ranking alerts]
    |
    v
[5.3 Lab result]
    |
    v
[5.4 Escalation]
    |
    v
[5.5 Recording]
    |
    v
[5.6 Asset list]
    |
    v
[Worked example] --> [Exercise EX017]

Learning outcomes

You will (1) explain what triage means in a SOC; (2) rank alerts by severity and asset importance; (3) decide when to escalate; (4) record triage decisions clearly.

5.1 What triage is

Triage is the quick first look at an alert to decide what it is and how urgent it is. The aim is not to finish the investigation but to put each alert in the right place: close it, investigate it now, or escalate it. Most alerts in Northgate's queue need only a few minutes to place correctly. A2, the new payroll admin, was closed quickly once Carlos found the approved change ticket. A4 went to a closer look in the proxy logs. Getting each into the right place frees time for the few that become incidents.

5.2 Two inputs

Urgency depends on how serious the activity is (severity) and how important the affected system is (asset criticality). A new admin on a payroll server matters more than failed logons on a library kiosk, even if both rules are "medium". The payroll server handles staff pay, so a new admin there could affect every employee, while a kiosk in the library holds no personal data. The asset list supplies the criticality value, and the rule supplies severity, so the analyst does not have to judge both from memory under pressure.

Lab — ranking alerts

"""Rank synthetic alerts by severity x asset criticality (1-3 each)."""
alerts = [("A1", "Malware blocked on laptop", 2, 1), ("A2", "New admin on payroll server", 3, 3),
          ("A3", "Failed logons on library kiosk", 1, 1), ("A4", "Outbound to new domain from finance PC", 2, 3),
          ("A5", "Disabled AV on reception PC", 2, 2)]
for aid, text, sev, crit in sorted(alerts, key=lambda a: -a[2] * a[3]):
    score = sev * crit
    pri = "P1" if score >= 9 else "P2" if score >= 6 else "P3" if score >= 3 else "P4"
    print(f"{aid} score={score} {pri} {text}")

Run with python3 lab_triage.py. Verified output:

A2 score=9 P1 New admin on payroll server
A4 score=6 P2 Outbound to new domain from finance PC
A5 score=4 P3 Disabled AV on reception PC
A1 score=2 P4 Malware blocked on laptop
A3 score=1 P4 Failed logons on library kiosk

5.3 Lab result

Multiplying severity by criticality (each 1–3) puts the new admin on the payroll server first (score 9, P1), outbound traffic from a finance PC to a new domain second (6, P2), disabled antivirus on a reception PC third (4, P3), and the blocked malware and kiosk failures last (P4). The blocked malware is low because the protection worked, but it is still checked later. The score is a guide to order, not a decision about what the alert means. Carlos follows the scores unless he records a reason to depart from them.

5.4 Escalation

Carlos escalates to Aisha when an alert is P1, when he is unsure, or when an action would affect services. Escalating is not failure; guessing is. In the parks01 case, Carlos could disable the account without escalating, because the playbook allows it and it affects only the shared account. When the gardeners needed accounts for timesheets, he involved IT. Escalating when unsure costs Aisha a few minutes; a wrong guess on a P1 alert could cost much more. His escalations are logged with the reason, so Aisha can see the pattern over time.

5.5 Recording

Each triage note states what was seen, what was checked, the decision and the reason. "Closed — benign" with no reason helps no one. Carlos's note for A2 shows the pattern: a new admin account on the payroll server, checked against the change system, matched an approved change ticket for the payroll upgrade, closed as benign with the ticket number. A reviewer can verify that in seconds, while 'closed — benign' alone would force them to repeat the work. Good notes also give Carlos's later tuning work the real and benign counts it depends on.

5.6 Asset list

Triage depends on knowing which systems matter. Northgate keeps an asset list with a criticality value for each server and group of PCs, maintained with IT. The scores in the triage lab depend entirely on this list. If the payroll server were missing or marked as low criticality, A2 would have dropped to the bottom of the queue. Maintaining the list with IT means new servers, such as those added for the payroll upgrade, get a value before alerts arrive.

Worked example

At 10:30, five alerts are waiting. Carlos uses the scores, takes A2 first, finds that IT created the admin account for a planned payroll upgrade with an approved change ticket, and closes it with the ticket number. He then takes A4, the finance PC, which needs a closer look and links to chapter 8.

Synthetic case. Alerts and scores are synthetic.

Errors and limits

A simple score can mislead; an analyst's judgement can override it with a recorded reason.

Exercises

Synthesis

Triage combines severity and asset importance, escalates when needed and records clear reasons.

Continue studying — chapter 05 of 18

← Chapter 04 (draft) · Course chapter index · Chapter 06 (draft) →