ASSURED

The fast path: triage at volume

The intro makes two claims that look incompatible. SOCs see thousands of alerts per day, and the full seven-phase arc takes an expert 25–80 minutes per alert. Run the math on those two numbers and no team on earth can operate this methodology. The reconciliation is that the full arc is not the unit of triage work; the depth ladder is. Depth is a decision the analyst makes per alert, and most of a real queue closes on the ladder’s lowest rung.

The seven chapters teach the full arc because that is the skill that has to exist before it can be compressed: an analyst who cannot run Subject cannot safely skip it. This page is the operating model that the trained skill plugs into.

The depth ladder

Level 0

Pattern close

≤ 5 minutes

For alerts that match a documented known-benign pattern in the team’s pattern library. The analyst validates the match, records a five-field close, and moves on. This is where the bulk of a healthy queue dies: the “majority of alerts are routine or false-positives” the Validation page describes.

What runs

  • Alert, compressed: confirm the alert’s discriminators match the documented pattern, not just its shape
  • Documentation, compressed: the five-field record, referencing the pattern by ID

Entry criteria (all required)

  • A written pattern entry exists, with named discriminators, an owner, and a current review date
  • Every discriminator checks out; nothing about the alert is novel
  • The subject passes the eligibility gate, proven from source systems, never assumed: not a crown-jewel system, not a privileged identity, not automation holding sensitive capability (deploy, signing, secrets, repository write; a CI runner can outrank its owner), and no regulated data in reach. Unknown fails the gate.
Level 1

Standard triage

~15–45 minutes

The compressed pass for alerts with no matching pattern but a bounded blast radius. Every phase still happens; several collapse into single moves.

What runs

  • Validate: Alert, as taught
  • Context: Subject and Scope as one sweep, asking who is this and what can they reach
  • Investigate: Uncover narrowed to the one question the verdict turns on
  • Decide: Risk verdict, then close or escalate
  • Document: as-you-go, using the alert report template

Entry criteria

  • No documented pattern match, or a match with one discriminator failing
  • Single subject, ordinary privilege, no regulated-data exposure on its face
  • The verdict question is answerable from telemetry you already have
Level 2

Full arc

the intro’s time table

The seven phases as the chapters teach them, with the Scope → Uncover → Risk loop running until the residual risk is understood. This is what the intro’s time table prices, and it is reserved for the alerts that earn it.

What runs

  • Alert → Subject → Scope → Uncover → Risk → Escalation → Documentation, in full

Entry criteria (any one suffices)

  • Anything suspicious survived Level 1 without a defensible verdict
  • Crown-jewel subject, privileged identity, or regulated data in reach
  • A novel detection, or multiple alerts correlating into a chain

Ladder rules

⬆️ The ladder is a ratchet

Any surprise moves the case up a level, and it never slides back down mid-case. A failed discriminator at Level 0 makes the alert a Level 1 case. A Level 1 context sweep that finds a second subject, a privileged account, or regulated data makes it Level 2. Down-scoping happens only between cases, never within one.

🚨 Break-glass overrides everything

The ladder governs how much process an alert gets, not when to escalate. A canonical escalation criterion confirmed at any level escalates immediately under the break-glass rule, even from inside a five-minute Level 0 check. Depth and urgency are separate decisions.

📚 Level 0 runs on a pattern library, not on memory

”I’ve seen this before” is not a pattern. A pattern entry is written down, has named discriminators (the checks that distinguish the benign behavior from the threat it mimics), an owner, and a review date; a reusable schema ships as pattern-entry.md. Every Level 0 close references the entry it matched, which is what makes five-minute closes defensible instead of sloppy, and what makes a wrong pattern correctable in one place. If the same unmatched alert closes at Level 1 three times, that is the signal to write the pattern entry and file the tuning feedback.

🤖 Automation moves the starting line, not the bar

When a SOAR (concept) Security orchestration, automation, and response: define, automate, and orchestrate IR workflows at scale. playbook pre-runs enrichment (identity lookups, asset criticality, sandbox verdicts), it is pre-answering Subject and Scope questions, so Level 1’s context sweep starts from the enrichment output instead of from scratch. What automation does not change is the evidentiary bar: the analyst still confirms the discriminators. Enrichment is input to the ladder, never a verdict.

The five-field record

Level 0’s entire documentation burden. Anything that cannot be honestly captured in these five fields does not belong at Level 0.

1 · AlertAlert ID, detection source, timestamp.
2 · PatternThe pattern-library entry this matched, by ID and name, with its owner and current review date.
3 · ChecksThe eligibility gate first, each item from its source system (asset criticality, privilege and sensitive capability, regulated-data reach); then the discriminators verified, with what was actually observed: not “matches pattern” but “signed vendor binary, expected install path, no persistence.” An unknown gate check ends the Level 0 close right here.
4 · VerdictBoth axes: detection correctness (did the rule detect what it looks for?) and activity disposition (benign-confirmed / authorized / malicious / undetermined, one line of justification; only the first two can close at Level 0). A correct detection of benign behavior is a Benign True Positive An alert that fired on exactly the activity its detection logic describes, where that activity turns out to be authorized or expected in the local context: a red-team exercise, an admin's sanctioned use of a dual-use tool, a scanner doing its job. The detection worked; the context clears it. Distinct from a false positive, where the logic matched something it should not have. The close still feeds tuning, because the record is what teaches the detection about the local context. , not a False Positive A security alert that fires on activity that is, on inspection, benign. The detection logic matched a pattern that looked malicious but was not. Distinct from a benign true positive , which is real adversary-like activity that does not warrant action in the local context. .
5 · DispositionClosed at Level 0; analyst and time; tuning ticket reference if the rule keeps firing.

A copy-ready version lives on the templates page, alongside the full nine-section packet.

What the ladder is not

The ladder is not permission to skip thinking. Level 0 without a real pattern library degrades into bulk-closing by vibes, the exact failure mode Validation exists to prevent. The discipline is the trade: five-minute closes are earned by the written pattern entry, the ratchet, and the break-glass rule, not granted by the timer.

Key Takeaway

Depth is a per-alert decision, made once at intake and revised only upward. Level 0 pattern-closes the routine majority in five minutes against a written pattern library. Level 1 runs the compressed pass when there is no pattern but the blast radius is bounded. Level 2 is the full arc the chapters teach, reserved for cases that earn it. Break-glass escalation cuts across all three: confirmation escalates now, from any level.

← The methodologyCopy-ready templates →