Event triage vs. incident response
Two different jobs
🧩 Framing the puzzle
Goal: assemble enough of the picture to know what an alert is and whether it deserves further response. The work ends with a verdict and a handoff packet.
Mindset: structured, time-bounded, defaults toward escalating when criteria are met.
Output: structured triage record, ATT&CK mapping, recommended priority.
🛠️ Completing the puzzle
Goal: contain the incident, eradicate the adversary, recover affected systems, and produce the post-incident report. The work ends with the organization returning to a known-good state.
Mindset: deep, sustained, defaults toward maintaining containment until eradication is confirmed.
Output: contained incident, restored systems, root cause analysis, lessons learned.
Where the line is
The line falls at the point where investigation transitions to coordinated response. Triage decides what is going on. IR decides what to do about it. Both phases require investigation, but the questions, the timelines, and the audiences are different.
Containment authority: the pre-authorized immediate actions
“IR owns containment” has one deliberate exception. Mature SOCs maintain a short, written list of pre-authorized immediate actions that triage may execute without waiting for IR: typically isolate a host, disable an account, terminate a session. The authority comes from the playbook, agreed in advance with IR and the business owners, not from the analyst’s judgment in the moment. Everything on the list is reversible, logged in the communication record, and reported in the handoff packet’s containment section. Everything beyond the list (network segmentation, fleet-wide credential rotation, infrastructure blocks, anything with business-continuity tradeoffs) is containment strategy, and that is IR’s call. When the worked example shows the triage analyst disabling an account and isolating hosts before IR arrives, that is this list at work, not triage doing IR’s job.
The vocabulary: event, alert, incident
The three terms get used interchangeably in casual conversation and lose precision under pressure. ASSURED treats them as distinct.
Any observable occurrence
Any observable occurrence in a system or network (NIST SP 800-61): a login, an email delivered, a blocked connection, a configuration change. An event is neither good nor bad on its own. It is raw observability data.
An event meeting a threshold
A particular event, or an aggregated group of events, that crosses a threshold requiring investigation and action. Alerts are the boundary between observability and SOC work.
A confirmed violation requiring response
A violation, or imminent threat of violation, of security policy or standard security practice (NIST SP 800-61), typically confirmed out of one or more alerts. Incidents are what escalation hands to IR.
Why the vocabulary matters
“We had an incident” and “we had an alert” sound similar but mean very different things in mature SOCs. An alert is something triage acts on. An incident is something IR coordinates. The line between them is where Escalation lives.
Event triage in depth: framing the puzzle
Event triage opens the security response lifecycle. It is high-efficiency, time-sensitive, and designed to answer a single decisive question: does this event warrant escalation?
Rather than assembling every piece of the puzzle, triage is about putting just enough pieces together to recognize what you’re looking at. Analysts focus on the most informative, high-confidence elements (confirmed IOCs, asset relevance, contextual Telemetry Collection and transmission of security-relevant data from remote sources for monitoring and analysis. ) to determine whether further investigation is necessary.
🎯 High-confidence starting points
Use well-structured data such as known malicious IPs, hashes, or attack techniques as anchors. These serve as the “corner pieces” that guide rapid assessment and provide definitive indicators of potential compromise.
🧭 Contextual awareness
Incorporate asset classification, user roles, geographic origin, and behavioral baselines. Context transforms raw technical data into meaningful security insights.
🎯 Targeted information gathering
Focus on collecting only the data required to make a go / no-go decision. Avoid exhaustive log reviews unless directly relevant to initial indicators. Efficiency prevents analysis paralysis.
🚦 Defined escalation criteria
Build and follow clearly defined rules that dictate when an event should hand off to incident response. Criteria should be threat-informed, asset-aware, and consistently applied.
Why rapid closure of non-threats matters
A critical yet often overlooked component of successful triage is the rapid closure of non-threats. When an alert is confirmed as a false-positive or expected behavior, it should be quickly documented and closed, with rationale captured for future detection tuning or suppression-rule creation.
This prevents alert-backlog accumulation and keeps analyst attention focused on genuine security concerns. By design, triage prevents analysts from getting bogged down in low-fidelity events, ensuring that time and energy are preserved for high-risk scenarios.
The methodology’s operating model for this is the fast path: a defensible five-minute close is a Level 0 pattern close (an alert matched against a documented pattern and recorded in five fields), not a shortcut through the phases.
Done right, triage becomes the force multiplier for the entire security operation, getting the most out of limited resources.
Incident response in depth: completing the puzzle
Once triage concludes that an event is legitimate and potentially harmful, it transitions to Incident Response The organized approach to addressing and managing the aftermath of a security breach or cyberattack, including preparation, detection, analysis, containment, eradication, and recovery. , a thorough and methodical process where analysts seek to complete the entire picture. IR takes the partially assembled puzzle and builds it out in full: root cause, attacker behavior, impact scope, and remediation path.
Full attack reconstruction
Identify initial vector. Map all attacker activity. Build a detailed timeline of lateral movement, privilege escalation, data access, or exfiltration.
Containment and control
Implement measures to prevent further damage. Isolate endpoints, revoke credentials, block malicious infrastructure, segment the network. Balance security with business continuity.
Eradication and remediation
Remove all traces of attacker presence. Rebuild systems from clean images, patch exploited vulnerabilities, close configuration gaps, validate that the same vectors cannot be re-exploited.
Recovery and lessons learned
Restore systems and improve defenses. Coordinate stakeholder communication. Engage legal, compliance, and executive leadership. Conduct formal post-incident review.
IR is more than technical work
Incident response extends beyond technical remediation to include structured communication with stakeholders, coordination across multiple teams, and fulfillment of regulatory or contractual obligations. Legal counsel, compliance officers, executive leadership, and potentially third-party partners must be engaged through established channels to ensure synchronized action.
How to know which work this is
If the question is “is this real?”
It is triage.
If the question is “how do we stop it?”
It is incident response.
If both questions are still open
The case is in the handoff. Escalation is the bridge.
Key Takeaway
Triage frames the puzzle: just enough pieces to recognize what you are looking at and whether it deserves further response. IR completes the puzzle: full reconstruction, containment, eradication, recovery. The methodology treats them as related but separate, and Escalation is the deliberate transition between them.