Alert triage is the first sorting of security alerts, to find the few real attacks among thousands of false alarms. Every security product in a company sends alerts: the email filter, the login system, the endpoint agent on each laptop and the firewall. A large company can receive tens of thousands of alerts a day, and almost all of them are harmless. Someone has to look at each one and decide whether to close it, watch it or act on it now. The word comes from hospitals, where triage means deciding which patient must be seen first.
Here is how it works. The alerts arrive in one queue, often in the company's SIEM, one searchable log of everything that happened in its systems. Details such as the user, the device and the recent activity are attached to each alert. Routine alerts are closed. The rest are ranked by how unusual and how dangerous they look. The top alerts go to an analyst in the security operations centre, or SOC, a team that watches alerts in shifts around the clock. The analyst checks each one and decides whether it is a real attack.
Triage uses several tools. User and entity behaviour analytics learns what is normal for each user, so it can flag behaviour that is unusual for that person. SOAR runs the response steps automatically, such as cutting a laptop off from the network. An AI SOC analyst is an AI model that reads every alert first and leaves the analysts only the handful that matter. A company that cannot staff a SOC pays a managed detection and response provider, whose own analysts do the triage.
Take, for example, a company's email filter, which flags hundreds of suspicious emails a day. Triage closes the known spam and sends the one email that led an employee to type a password on a fake page to an analyst.
Consider a payment website that slows down during a Diwali sale. An AI SRE reads the alert and the logs first, and gives the engineer on call a likely cause.
In a telecom network, for instance, one broken cable can raise a hundred alarms. Network AIOps groups them into one incident and names the cable as the likely cause.
How is alert triage different from anomaly detection? Anomaly detection finds unusual events and raises alerts. Triage comes after it: it decides which of those alerts are real and urgent. In hospitals, triage applies the same idea to patients.
Appears in
- Network detection and response (NDR)↗ Enterprise cybersecurityNDR raises alerts on unusual network traffic, and attaches the recorded traffic so analysts can check quickly.
- Application security posture management (ASPM)↗ Enterprise cybersecurityASPM removes duplicate findings from many scanners and ranks the rest, so developers fix the important ones first.
- SIEM↗ Security operations centre (SOC)A SIEM raises thousands of alerts a day from its rules, which analysts then triage one by one.
- User and entity behaviour analytics (UEBA)↗ Security operations centre (SOC)UEBA ranks alerts by how unusual the behaviour is for that user, which helps analysts pick the real ones.
- SOAR↗ Security operations centre (SOC)SOAR looks up the details for each alert automatically, so the analyst starts triage with the facts ready.
- AI SOC analyst↗ Security operations centre (SOC)An AI SOC analyst reads every alert first, and passes only the few real ones to people.
- Managed detection and response (MDR)↗ Security operations centre (SOC)An MDR provider's analysts triage a company's alerts around the clock, and call the company only for real attacks.
- Security operations platform↗ Security operations centre (SOC)A security operations platform puts the alerts from all the company's tools into one queue for triage.
- Video analytics↗ Smart buildingsVideo analytics raises an alert when a camera sees someone tailgating, and a guard checks whether it is real.
- Network AIOps↗ Observability and monitoringNetwork AIOps groups a hundred network alarms into one incident and names the likely cause.
- AI SRE↗ Observability and monitoringAn AI SRE triages a production alert at 2 a.m., and wakes the on-call engineer only if needed.