ASSURED
Quick reference
Alert, Subject, Scope, Uncover, Risk, Escalation decision, Documentation

Triage with confidence. Assemble the puzzle.

ASSURED is a structured methodology designed for repeatable security event triage. Each case, whether one alert or a group of related ones, is its own puzzle, and the analyst's job is to assemble just enough of the picture to know what they are looking at and what to do next. Seven phases in three stages (Orient, Investigate, Resolve), one consistent way to work, and a fast path for routine alerts.

Read the introduction Start with Alert On shift? Open the quick reference
ASSURED methodology, seven pieces locking into place Seven puzzle pieces, one per phase (Alert, Subject, Scope, Uncover, Risk, Escalation decision, Documentation), fly in from scattered positions and lock together edge-to-edge.
Why this exists

Incident-response frameworks map the whole lifecycle. ASSURED works the first step, one case at a time.

Event triage is a distinct skill, separate from the broader incident response work it feeds into, yet it is often learned informally on the job. Triage itself is long established: CERT/SEI's incident-management process model names it as a process, and FIRST's CSIRT Services Framework lists it as a function. ASSURED makes the craft explicit as an open, versioned procedure analysts can learn, teach, and refine. It was written by security engineer Timothy Zilber, who learned triage through a supervised lateral-work arrangement and now teaches ASSURED in a workplace lateral-work program.

A method for the alert-to-decision window

NIST SP 800-61r3, SANS PICERL (preparation, identification, containment, eradication, recovery, lessons learned), and the Dynamic Approach to Incident Response (DAIR) taught in SANS SEC504 define the incident-response lifecycle and treat triage as one step inside it, described at program level. MITRE ATT&CK catalogs adversary behavior. ASSURED expands that triage step into a repeatable per-case procedure: build the picture, case by case, before an incident is declared.

Built for mentees and seasoned analysts

Every chapter pairs a concept with the questions a triage analyst should ask and the artifacts they should leave behind. Junior analysts get scaffolding to lean on while their instincts develop. Senior analysts get a checklist that travels with the handoff.

Triage is not strictly linear

ASSURED's seven phases have a default order, but feedback loops back to earlier phases are explicit. Risk findings send you back to Uncover. Uncover surfaces new Subjects. A confirmed escalation criterion exits from any phase (the escalation tripwire). The methodology embraces that flow rather than pretending triage is an assembly line.

Evidence status: practice-derived, taught in a supervised workplace program and used daily on the author's own case queue; not yet evaluated in a controlled or comparative study. See Development and evidence for what would count against it.

One case, seven phases

A Cursor IDE alert that closes as a benign true positive

One of the three threaded cases the chapters work in full, compressed to one line per phase.

  1. Alert: at 14:03:11 UTC an endpoint detection and response (EDR) behavioral rule fires on a managed developer Mac: a helper process running without its sandbox spawns a child that opens an encrypted outbound socket.

  2. Subject: the frontend engineer, a standard user; the mobile device management (MDM) record shows Cursor's installed version and hash match the vendor release. The user's SSH keys reach the build environment, so the impact read is High.

  3. Scope: a primary window of 13:03 to 14:48, a forward watch to 18:03, one extension-layer check, and no regulatory clock triggered.

  4. Uncover: the child ran a bundled indexing script from inside the signed app, every destination is on Cursor's published allowlist, the installed extensions and the one Model Context Protocol (MCP) server are approved and unchanged, the agent's commands trace to the user's prompt, and eleven other managed developer Macs show the same behavior.

  5. Risk: High impact, Low likelihood, High confidence: the High/Low cell, priority P3. Recommended move: keep working to the forward watch, then a documented close if it stays clean.

  6. Escalation decision: the forward watch comes back clean, and the analyst records a documented close at 18:08. Verdict: true positive; activity authorized (benign true positive).

  7. Documentation: the event report opens with the decision header, and detection engineering receives an enrichment request and a draft pattern entry. The rule itself stays unchanged: it fired on exactly what it describes.

Follow the case from the Alert chapter

Explore the methodology

Seven letters. Three stages. One method.

Each phase has an anchor question that frames the work, shown under its title, and a structured set of supporting questions underneath. Read in order, or jump to the phase you need.

Orient · A, S, S Validate the signal, identify who is involved, and set the boundaries.

Alert

What fired, and why?

Understand the detection logic, validate the signal, and parse the alert into something an analyst can act on.

  • Detection mechanisms: signature, anomaly, rule, behavioral
  • Validation: four checks (technical, environmental, intelligence, business)
  • Parsing: formats and normalization, command lines, process trees, network, file system, cloud and identity logs
Read chapter

Subject

Who is involved?

Identify every entity that authenticated or acted: human users, service accounts and other non-human identities (cloud roles, workloads, API keys, AI agents), endpoints, and network identifiers.

  • The four dimensions: authentication, authorization, behavior, relationships
  • Entity types: user, service account, host or device, application or OAuth grant, session or token, resource, artifact, network identifier, threat
  • Insider analysis and the Insider Threat Matrix
Read chapter

Scope

Where are the lines?

Set the time window, the entities in play, and the regulatory clocks that may start. Without scope, investigations sprawl.

  • Regulatory clocks: GDPR, HIPAA, PCI DSS, SEC 8-K Item 1.05, state breach laws, CCPA/CPRA, SOX
  • Time-based parameters and historical windows
  • Entity-based scope and dependency tracing
Read chapter

Investigate · U, R Gather the evidence, then judge how bad it is and how sure you are.

Uncover

What does the evidence say?

Pull the evidence. Correlate endpoint, network, identity and cloud telemetry into a confidence-labeled timeline, just enough to support a verdict.

  • Data sources for evidence gathering
  • Threat intelligence: tiers, validation, scoring
  • MITRE ATT&CK: tactics, techniques, procedures
Read chapter

Risk

How bad is it, and how confident are we?

Rate impact and likelihood, record your confidence beside them, and read the priority (P1 to P4) off the matrix. Risk recommends the move; the Escalation decision makes it.

  • Risk-based alert triage matrix
  • Impact, likelihood, confidence, and actor sophistication
  • What a benign close teaches
Read chapter

Resolve · E, D Make the close-or-escalate call, and leave a record someone else can replay.

Escalation decision

Close or escalate, and who needs to know?

Make the call and record it. A documented close is a first-class verdict; a confirmed criterion or a P1 or P2 case escalates with a handoff packet the next tier can act on cold.

  • The documented close and the escalation criteria
  • Internal and external protocols
  • The handoff packet and the line between triage and incident response
Read chapter

Documentation

What did we decide, and what did we learn?

Produce the record the whole arc exists for: decisions, evidence, and reasoning an auditor or the next analyst can replay months later.

  • Standards and templates for consistent records
  • Documentation pitfalls and how to avoid them
  • Closure criteria and downstream uses
Read chapter
The depth ladder

Built for real queue volume

Not every case gets the full seven-phase arc. Depth is a decision the analyst makes per case, revised only upward. Related alerts are grouped into one case, and the case takes the level of its riskiest member. The typical times below are the author's practitioner estimates, not measured benchmarks.

Level 0 · Pattern close 5 minutes or less

A documented known-benign pattern, every discriminator checked and the eligibility gate passed, closed with a five-field record.

Level 1 · Standard triage about 15 to 45 minutes

No matching pattern but a bounded blast radius. Every phase still happens; several collapse into single moves.

Level 2 · Full arc about 25 to 80 minutes for a senior analyst

A crown-jewel subject, a privileged identity, regulated data plausibly accessed by the activity under review, or anything Level 1 could not resolve. The fast path prices each phase by experience level.

A confirmed escalation criterion escalates from any level (the escalation tripwire). Depth and urgency are separate decisions. Read the fast path.

Where to start

Read the introduction for the full picture, or jump straight into Alert, the first piece of the puzzle. Or start from your role, or choose your path through the whole site.

I'm an analyst

I lead a security operations center

I teach