Escalation Threshold
Definition
A defined criterion, based on severity level, asset type, or indicator type, that triggers handoff of an alert from a first-tier analyst to a more senior analyst or to a specialist team. Escalation thresholds are defined in the incident response plan and should be documented rather than left to analyst discretion.
- Basis
- Severity level, asset type, indicator type
- Defined in
- Incident response plan
- Function
- Triggers handoff from tier-1 analyst to a senior or specialist team
Common questions
How does an escalation threshold differ from escalation criteria generally?+
A threshold is a specific measurable trigger point, such as a severity score or asset classification, while escalation criteria more broadly describe the full set of conditions and process for when and how a handoff happens.
Why tie escalation thresholds to asset type rather than severity alone?+
An alert on a low-value test system and the same alert on a system holding regulated data pose very different risk, so factoring in asset type ensures escalation reflects actual business impact, not just technical severity.
Related terms
- Alert Fatigue
- The condition in which analysts receive more alerts than they can meaningfully review, leading to delayed responses, dismissed true positives, and reduced...
- Asset Criticality
- A pre-assigned score or label that records how important a system, service, or data set is to the organisation. Used during triage...
- False Positive
- A test result that indicates the presence of a target analyte when it is absent. In forensic serology this may mean incorrectly...
- Severity Matrix
- A two-dimensional scoring tool that combines technical impact and business impact to assign a severity level to a confirmed incident. Outputs are...
- Triage
- The structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level...