Triage
Definition
The structured process of evaluating an alert to determine whether it is a genuine security incident and, if so, what severity level it should be assigned. The term is borrowed from emergency medicine, where it describes the sorting of patients by urgency.
- Purpose
- Determine if an alert is a genuine incident and its severity
- Origin of term
- Emergency medicine patient sorting
- Input
- Security alerts from detection pipelines
- Output
- Escalation decision and severity assignment
Common questions
How does triage differ from full incident investigation?+
Triage is a fast initial assessment to decide whether an alert deserves escalation and how urgently, while full investigation involves deeper analysis of scope, root cause, and impact once an incident has been confirmed and prioritised.
What criteria typically determine the severity assigned during triage?+
Common factors include the criticality of the affected asset, evidence of active compromise versus a false positive, potential data exposure, and whether the activity matches a known high-risk technique, all weighed under time pressure.
Why is poor triage linked to alert fatigue?+
When triage criteria are unclear or detection rules generate excessive noise, analysts spend disproportionate time on low-value alerts, which delays genuine incidents and can lead staff to dismiss alerts that later prove significant.
Related terms
- Alert Fatigue
- The condition in which analysts receive more alerts than they can meaningfully review, leading to delayed responses, dismissed true positives, and reduced...
- Asset Criticality
- A pre-assigned score or label that records how important a system, service, or data set is to the organisation. Used during triage...
- Chain of Custody
- The documented chronological record of who collected, handled, transferred, and examined a piece of evidence. For digital evidence, chain of custody includes...
- Continuity Sample
- A portion of the original exhibit retained in the laboratory after analysis, so that an independent analyst can re-examine it if the...
- Escalation Threshold
- A defined criterion, based on severity level, asset type, or indicator type, that triggers handoff of an alert from a first-tier analyst...
- False Positive
- A test result that indicates the presence of a target analyte when it is absent. In forensic serology this may mean incorrectly...
- ISO/IEC 17025
- The international standard for testing and calibration laboratories, published jointly by the International Organization for Standardization and the International Electrotechnical Commission. It...
- LIMS
- Laboratory Information Management System: the software platform that tracks every exhibit, test request, result, and report within a laboratory. The electronic spine...
- Live Acquisition
- Forensic data collection performed on a running, powered-on system. Captures volatile data and allows imaging of encrypted volumes while decryption keys are...
- Preservation Order
- A legal instrument directing a service provider to retain specific data for a defined period pending receipt of a production order or...
- Section Routing
- The allocation of an exhibit to the appropriate specialist team within the laboratory, based on the nature of the material and the...
- Severity Matrix
- A two-dimensional scoring tool that combines technical impact and business impact to assign a severity level to a confirmed incident. Outputs are...
Explained in these topics
- The Forensic Laboratory Workflow and TriageThe process of prioritising which cases and which items within a case receive analysis first, based on seriousness, deadlines, evidence type persistence, and e...
- Intake, Scoping and Evidence PreservationThe rapid initial assessment of an incoming cybercrime complaint to determine severity, evidence-loss urgency, scope, and the priority level that governs how q...
- Triage and Incident Prioritisation