Alert triage: true and false positives, enrichment and escalation
In short: Triage is the quick, structured review of each alert to decide whether it is real, how serious it is and what happens next. Good triage relies on context from enrichment, clear escalation criteria and notes that let anyone follow your reasoning.
What triage means in a SOC
A Security Operations Centre (SOC) may receive hundreds of alerts a day. Triage is the first, time-boxed look at each one to answer three questions: Is it real? How bad could it be? What should happen next? The term comes from emergency medicine, where staff sort patients by urgency. The aim is not to investigate everything fully, but to make a safe, fast decision.
True, false and in between
A true positive is an alert about genuinely malicious activity. A false positive is an alert where the rule matched something harmless, such as a backup job flagged as data theft. A useful middle category is the benign true positive: the rule worked correctly, but the activity was authorised, for example an approved penetration test or an administrator running a scanner. Recording this separately helps detection engineers improve rules without hiding real risk.
A false negative is the dangerous one: an attack that raised no alert at all. You never see it during triage, which is why threat hunting and post-incident reviews matter.
Enrichment: adding context fast
Most decisions depend on context the alert does not contain. Typical enrichment questions are:
- Who is the user? Normal role, location, recent travel, privileged or not?
- What is the asset? Domain controller, test VM, CEO's laptop?
- Is it known? Does the hash, domain or IP address appear in threat intelligence or previous cases? Tools such as the hash generator help when comparing file hashes.
- What else happened? Look 30 minutes either side for related logins, processes or network connections.
- Has it happened before? A rule that fires every Monday at 02:00 may be a scheduled task.
Escalation and documentation
| Situation | Typical action |
|---|---|
| Clear false positive | Close with reason; suggest a tuning change |
| Benign true positive | Close, link the approval or change ticket |
| Confirmed malicious, contained to one host | Contain per playbook, escalate to tier 2 |
| Privileged account, data loss or several hosts | Escalate immediately and declare an incident |
| Unsure after the time box | Escalate with what you found; never sit on it |
Good case notes let a colleague understand your decision without asking you. Write what you checked, what you found, what you concluded and why. Include times, queries and links to evidence. "Closed: FP" with nothing else is a common mistake that hides patterns and makes audits painful.
Tip: when in doubt, escalate. A senior analyst would rather review a harmless alert than discover a missed breach weeks later.
Practice
A vulnerability scanner run by IT triggers a port-scan alert. How should it be classified?
Name three enrichment sources an analyst might use.
Why are detailed case notes important even for false positives?
Key takeaways
- Triage decides quickly whether an alert is real, how serious it is and what next.
- Distinguish true, false and benign true positives; false negatives need hunting.
- Enrich alerts with user, asset, intelligence and surrounding events.
- Use clear escalation criteria and escalate when unsure.
- Write notes that anyone can follow later.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.