Start here: choose your path

On shift now

You have an alert open and minutes, not hours.

1. The one-page reference: the seven questions, the escalation criteria, the verdict vocabulary and the priority bands on one card.
2. The fast path: pick the depth (Level 0, 1 or 2) and run the eligibility gate before you close anything.
3. When an identity is involved, the identity-persistence sweep.

Learning triage

Read the introduction, then the seven chapters in order. Each chapter closes with a worked example on the same cases and a quiz. Reading times cover each chapter’s pages except the quiz, at a steady 230 words a minute; a first read with the exercises takes longer.

Then the case files put each worked case back together, and cognitive traps names the reasoning failures the method is built to catch.

Leading a SOC

1. Adopting ASSURED: rollout, roles and maturity.
2. Measuring triage: the metric set and how each metric gets gamed.
3. Shift handover and operating variants: shifts, MSSP and MDR models, the one-person SOC.
4. Governing automated triage: what an AI agent may close, and under which controls.

Teaching

1. Teaching ASSURED: sessions, routing with a pre-assessment, and assessment design.
2. Hands-on exercises and telemetry labs for practice.
3. The facilitator kit for grading and the capstone.

Detection engineering

1. Triage and detection engineering: what triage owes detection engineering, and the tuning request.
2. How detections work and alert provenance: what an analyst can and cannot learn from a rule.
3. What a benign close teaches: turning closes into tuning.

Evaluating ASSURED

1. How ASSURED compares with incident-response frameworks and SOC models.
2. Standards mapping: NIST, ISO, SANS DAIR, CERT and FIRST, with the records an auditor can sample.
3. Development and evidence: what is established, what is not, and the planned evaluation.