ASSURED

The fast path: triage at volume

The intro makes two claims that look incompatible. SOCs see thousands of alerts per day, and the full seven-phase arc takes an expert 25–80 minutes per alert. Run the math on those two numbers and no team on earth can operate this methodology. The reconciliation is that the full arc is not the unit of triage work; the depth ladder is. Depth is a decision the analyst makes per alert, and most of a real queue closes on the ladder’s lowest rung.

The seven chapters teach the full arc because that is the skill that has to exist before it can be compressed: an analyst who cannot run Subject cannot safely skip it. This page is the operating model that the trained skill plugs into.

The depth ladder

Level 0

Pattern close

≤ 5 minutes

For alerts that match a documented known-benign pattern in the team’s pattern library. The analyst validates the match, records a five-field close, and moves on. This is where the bulk of a healthy queue dies: the “majority of alerts are routine or false-positives” the Validation page describes.

What runs

  • Alert, compressed: confirm the alert’s discriminators match the documented pattern, not just its shape
  • Documentation, compressed: the five-field record, referencing the pattern by ID

Entry criteria (all required)

  • A written pattern entry exists, with named discriminators and an owner
  • Every discriminator checks out; nothing about the alert is novel
  • The subject is not a crown-jewel system or privileged identity
Level 1

Standard triage

~15–45 minutes

The compressed pass for alerts with no matching pattern but a bounded blast radius. Every phase still happens; several collapse into single moves.

What runs

  • Validate: Alert, as taught
  • Context: Subject and Scope as one sweep, asking who is this and what can they reach
  • Investigate: Uncover narrowed to the one question the verdict turns on
  • Decide: Risk verdict, then close or escalate
  • Document: as-you-go, using the alert report template

Entry criteria

  • No documented pattern match, or a match with one discriminator failing
  • Single subject, ordinary privilege, no regulated-data exposure on its face
  • The verdict question is answerable from telemetry you already have
Level 2

Full arc

the intro’s time table

The seven phases as the chapters teach them, with the Scope → Uncover → Risk loop running until the residual risk is understood. This is what the intro’s time table prices, and it is reserved for the alerts that earn it.

What runs

  • Alert → Subject → Scope → Uncover → Risk → Escalation → Documentation, in full

Entry criteria (any one suffices)

  • Anything suspicious survived Level 1 without a defensible verdict
  • Crown-jewel subject, privileged identity, or regulated data in reach
  • A novel detection, or multiple alerts correlating into a chain

Ladder rules

⬆️ The ladder is a ratchet

Any surprise moves the case up a level, and it never slides back down mid-case. A failed discriminator at Level 0 makes the alert a Level 1 case. A Level 1 context sweep that finds a second subject, a privileged account, or regulated data makes it Level 2. Down-scoping happens only between cases, never within one.

🚨 Break-glass overrides everything

The ladder governs how much process an alert gets, not when to escalate. A canonical escalation criterion confirmed at any level escalates immediately under the break-glass rule, even from inside a five-minute Level 0 check. Depth and urgency are separate decisions.

📚 Level 0 runs on a pattern library, not on memory

”I’ve seen this before” is not a pattern. A pattern entry is written down, has named discriminators (the checks that distinguish the benign behavior from the threat it mimics), an owner, and a review date. Every Level 0 close references the entry it matched, which is what makes five-minute closes defensible instead of sloppy, and what makes a wrong pattern correctable in one place. If the same unmatched alert closes at Level 1 three times, that is the signal to write the pattern entry and file the tuning feedback.

🤖 Automation moves the starting line, not the bar

When a SOAR (concept) Security orchestration, automation, and response: define, automate, and orchestrate IR workflows at scale. playbook pre-runs enrichment (identity lookups, asset criticality, sandbox verdicts), it is pre-answering Subject and Scope questions, so Level 1’s context sweep starts from the enrichment output instead of from scratch. What automation does not change is the evidentiary bar: the analyst still confirms the discriminators. Enrichment is input to the ladder, never a verdict.

The five-field record

Level 0’s entire documentation burden. Anything that cannot be honestly captured in these five fields does not belong at Level 0.

1 · AlertAlert ID, detection source, timestamp.
2 · PatternThe pattern-library entry this matched, by ID and name.
3 · ChecksThe discriminators verified, with what was actually observed: not “matches pattern” but “signed vendor binary, expected install path, no persistence.”
4 · Verdict False Positive A security alert that fires on activity that is, on inspection, benign. The detection logic matched a pattern that looked malicious but was not. Distinct from a benign true positive , which is real adversary-like activity that does not warrant action in the local context. or expected behavior, one line of justification.
5 · DispositionClosed at Level 0; analyst and time; tuning ticket reference if the rule keeps firing.

A copy-ready version lives on the templates page, alongside the full nine-section packet.

← The methodologyCopy-ready templates →