A security alert is a question the detection engine is asking the analyst. Is this real, is it malicious, how serious is it, and what should happen next?
Event triage is the work of answering those questions with confidence, and it is a distinct skill from broader incident response. Three words matter from here on: an event is any observable occurrence, an alert is an event a detection flagged for a human, and an incident is a confirmed (or imminent) violation that incident response (IR) owns. Triage turns alerts into one of two outcomes: a documented close or a declared incident. ASSURED is a structured, repeatable methodology for doing that work consistently. Its seven letters, Alert, Subject, Scope, Uncover, Risk, Escalation decision and Documentation, cover the full arc from the moment an alert fires to the moment the analyst closes the case or hands it off.
The letters are the method. Each one is a question the analyst answers before moving on:
Two naming traps are worth defusing now. The two S’s: who before where. Subject resolves the person or system behind the activity; Scope then draws the lines around it. You cannot bound an actor you have not identified. And the E: Escalation is the decision, not the outcome. Most triaged cases close at E. Risk rates the case and recommends a move; the Escalation decision makes the close-or-escalate call on the evidence and records it. The thinking traps (anchoring, confirmation bias and their relatives) have their own page, Cognitive traps in triage.
Here is Case A, the finance-team phishing intrusion that threads through the worked examples, one line per letter:
Triage is not incident response
Triage produces the close-or-escalate decision; IR runs the response once a case is escalated. They are different jobs even when one person does both: on a small team, the escalation decision is the moment you change hats, and it still deserves a written handoff to your future self. Triage vs. IR draws the full line.
The diagram below shows how the seven phases group into three stages and where the loop runs. Each phase contributes specific evidence to the next.
Orient (A, S, S)
Investigate (U, R)
Feedback loop: refine scope, re-uncover, re-validate. The loop runs from Risk back to Scope.
Escalation tripwire: a confirmed criterion exits from any phase, straight to the Escalation decision.
Resolve (E, D)
What fired, who is involved, where the boundaries are. Without it, every later step is built on a guess.
Pulls in telemetry Telemetry The event streams that endpoints, network sensors, identity providers, SaaS apps and cloud control planes emit about what happened on them. Triage can only see what was collected: when telemetry is missing for a host or time window, record it as a gap (unknown is not Low), not as clean. and correlates it across systems, then rates what was found (impact, likelihood and the confidence behind them) and recommends a move. Most of the active investigative work happens here.
Makes and records the close-or-escalate decision, then produces the closure record (or the handoff to the next tier) that lets someone else reconstruct the decision months later.
The loop is intentional. Risk findings often send the analyst back to Uncover for more evidence, and Uncover sometimes reveals subjects the alert never mentioned. A new entity re-enters Subject briefly (run the four dimensions on it), and Scope then redraws the boundary.
Each problem is addressed by at least one phase, and every phase addresses at least one problem.
Thousands of alerts a day (Vectra AI’s vendor-commissioned surveys put the average at 2,992 in 2026), most of them false positives or benign true positives by analysts’ own account (Alahmadi, Axon & Martinovic, USENIX Security 2022, a qualitative study). Addressed by: Alert, especially its validation step.
Telemetry is split across the SIEM, EDR, identity provider, cloud audit logs and SaaS consoles, each with its own query language and retention. Addressed by: Uncover, which makes source selection and correlation explicit.
Valid accounts, stolen session tokens, remote-management tools and living-off-the-land binaries look like normal operations. Addressed by: behavioral analysis in Alert’s validation step and in Subject.
GDPR, HIPAA, PCI DSS, SOX and the SEC’s cyber-disclosure rule set evidence duties, and several notification clocks run from awareness, not from case closure. EU regimes such as NIS2 and DORA cut the first report to hours; the regulatory clock card lists them. Addressed by: Scope, the Escalation decision and Documentation.
One investigation crosses the SIEM, SOAR SOAR (concept) Security orchestration, automation, and response: define, automate, and orchestrate IR workflows at scale. , EDR, identity systems and cloud consoles, and context switching erodes accuracy. Addressed by: the structure itself, which names the next step at every moment.
The same alert closes on one shift and escalates on the next. Addressed by: Risk (shared scales, a stated confidence, a priority) and the Escalation decision (pre-committed criteria, the escalation tripwire, a recorded decision).
Inconsistent records make post-mortems painful, trend analysis impossible and audits stressful. Addressed by: Documentation.
Three aims, none of them measured yet; Development and evidence says what has and has not been established.
How long each phase takes, by experience level, and why most alerts never need the full arc, is on the fast path.
Incident-response Incident Response The organized approach to handling a security incident once it is declared. The classic lifecycle (NIST SP 800-61r2, withdrawn in 2025, and SANS PICERL) runs preparation; detection and analysis (identification); containment, eradication and recovery; post-incident activity (lessons learned). NIST SP 800-61r3 (April 2025) now maps incident response onto the CSF 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover). Triage is the front edge of that lifecycle; ASSURED ends where IR takes ownership. frameworks treat triage as one step inside a larger lifecycle. NIST SP 800-61r3 (April 2025) states it as outcomes and leaves the how-to to each organization; SANS PICERL (Preparation, Identification, Containment, Eradication, Recovery, Lessons learned) and the newer Dynamic Approach to Incident Response (DAIR) each give it a single phase; MITRE ATT&CK MITRE ATT&CK MITRE's public knowledge base of adversary tactics, techniques and procedures observed in real intrusions, with Enterprise, Mobile and ICS matrices. Enterprise v19 (April 2026) split Defense Evasion into Stealth and Defense Impairment. Triage uses it as a shared vocabulary: map what the evidence shows to technique IDs, record the version, and remember that a mapping names behavior without scoring it. See the ATT&CK Tactic, Technique and Procedure entries. catalogs adversary behavior once you know what you are looking for. The standards mapping shows which CSF 2.0 outcomes and which ISO/IEC 27001 control (A.5.25) the method serves, and what record proves each. Event triage Event Triage The front end of incident response, from an alert firing to the documented decision to close it or escalate it. It answers four questions: is this real, is it malicious, how serious is it, and what should happen next. It ends in a documented close or a handoff to IR. ASSURED is a structured way to do triage. , the alert-by-alert work of deciding what you are looking at, is still often learned informally on the job. ASSURED expands that one step into a per-alert workflow: scaffolding for newer analysts, a checklist for experienced ones (the printable one-page reference), and a shared vocabulary for handoff and review. The related-work map sets out the neighbors and a crosswalk to the standards, and Development and evidence covers the framework’s origin and its validation limits.
Recommended path
On a first read, take the letters in order: A, S, S, U, R, E, D. Experienced analysts can take the twelve-item pre-assessment first and read only the pages for the items they miss. After that, jump to whatever phase the day’s case demands; every chapter and glossary stands alone as a reference.
Technical details verified . Product names, defaults and retention change; check your own tenant.