ASSURED is a structured, repeatable methodology for security event triage. Each alert is its own puzzle, and the analyst's job is to assemble just enough of the picture to know what they are looking at and what to do next. Seven components, three phases, one consistent way to work.
ASSURED is about the step before that. Event triage is a distinct skill, separate from the broader incident response work it feeds into, and until now it did not have a dedicated method that analysts could learn, teach, and refine.
Tap any card to see the full picture.
Each phase has an anchor question that frames the work, and a structured set of supporting questions underneath. Read in order, or jump to the phase you need.
Understand detection logic, validate the signal, parse alert metadata into something an analyst can act on.
Identify the who. Any entity that authenticated or acted: user, robot account, EC2 instance, cloud role, service.
Decide where the lines are. Time windows, entities in play, regulatory boundaries. Without scope, investigations sprawl.
Pull the evidence. Correlate endpoint, network, identity, and cloud telemetry to find root cause.
Decide how bad. Asset criticality, attacker sophistication, business impact, likelihood. Risk turns evidence into priority.
Hand it off cleanly. The triage analyst's deliverable is the handoff packet: context, evidence, and a recommendation.
Close the loop. Decisions, evidence, and reasoning so the next analyst and the auditor can replay your thinking.
Read the introduction for the full picture, or jump straight into Alert. The first piece of the puzzle.