Triage
Definition
The structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level it should be assigned. The term is borrowed from emergency medicine, where it describes the sorting of patients by urgency.
Related terms
- Alert Fatigue
- The condition in which analysts receive more alerts than they can meaningfully review, leading to delayed responses, dismissed true positives, and reduced...
- Asset Criticality
- A pre-assigned score or label that records how important a system, service, or data set is to the organisation. Used during triage...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Continuity Sample
- A portion of the original exhibit retained in the laboratory after analysis, so that an independent analyst can re-examine it if the...
- Escalation Threshold
- A defined criterion, based on severity level, asset type, or indicator type, that triggers handoff of an alert from a first-tier analyst...
- False Positive
- A test result that indicates the presence of a target analyte when it is absent. In forensic serology this may mean incorrectly...
- ISO/IEC 17025
- The international standard for testing and calibration laboratories, published jointly by the International Organization for Standardization and the International Electrotechnical Commission. It...
- LIMS
- Laboratory Information Management System: the software platform that tracks every exhibit, test request, result, and report within a laboratory. The electronic spine...
- Live Acquisition
- Forensic data collection performed on a running, powered-on system. Captures volatile data and allows imaging of encrypted volumes while decryption keys are...
- Preservation Order
- A legal instrument directing a service provider to retain specific data for a defined period pending receipt of a production order or...
- Section Routing
- The allocation of an exhibit to the appropriate specialist team within the laboratory, based on the nature of the material and the...
- Severity Matrix
- A two-dimensional scoring tool that combines technical impact and business impact to assign a severity level to a confirmed incident. Outputs are...
Explained in these topics
- The Forensic Laboratory Workflow and TriageThe process of prioritising which cases and which items within a case receive analysis first, based on seriousness, deadlines, evidence type persistence, and e...
- Intake, Scoping and Evidence PreservationThe rapid initial assessment of an incoming cybercrime complaint to determine severity, evidence-loss urgency, scope, and the priority level that governs how q...
- Triage and Incident PrioritisationThe structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level it should be assigned. The...