Triage and investigation

First, a quick disclaimer: organizations may already have a ticketing system or escalation path configured for alert escalation. Often, this activity is managed by a security incident and event management (SIEM) solution in tandem with a ticketing system (such as ServiceNow). The way that alerts get to your analysts in those scenarios is outside of our scope for the chapter. Though we will mention that the Microsoft Sentinel team has several roadmap items that will make that platform more robust for documentation and resolution of alerts in the near future – so, stay tuned to their public communications. That said, on with triage and investigation.

On a day-to-day basis, an analyst will be engaging in alerts or incidents and will need to perform triage – which is, at its most basic, prioritizing tasks. The modern interpretation of this term originates from the military assessment of battlefield wounded. Though military slang is often overused...