SOC Alert Triage Process: The 5-Phase Method That Works at 2AM

Alert triage is the most time-critical skill in a SOC analyst's toolkit. Done well, it separates a false positive from a contained incident in under 10 minutes. Done poorly, it means closing a P1 as noise while an attacker moves through your environment.

This 5-phase process was built from 10 years of daily alert work across CrowdStrike Falcon, Splunk, and Microsoft Sentinel at major Canadian financial institutions. It is designed to be followed under pressure, at 2AM, by an analyst who is tired and staring at an unfamiliar alert.

The Severity Matrix

Before starting the 5 phases, you need a clear severity framework. Gut feel is not a process. Every analyst on your team should apply the same severity to the same alert.

Severity	Definition	Response Time	Action
P1	Active breach, live execution, confirmed data exfiltration, or ransomware	Immediate	Page IR lead now, isolate affected systems
P2	Confirmed malicious activity, contained or potentially active, no confirmed data loss	Within 15 minutes	Escalate to senior analyst, begin containment
P3	Suspicious activity requiring investigation, no confirmed malicious action	Within 1 hour	Investigate and document findings
P4	Low-risk anomaly or policy violation, no threat indicators	Same shift	Log, monitor, and close with documentation

Phase 1: Read Before You Act

The most common triage mistake is jumping straight to investigation without reading the full alert. Analysts miss secondary indicators that were right there in the alert fields because they started pivoting on the first thing they saw.

Phase 2: Build Context

Context is what separates a 45-minute investigation from a 3-minute false positive close. A certutil.exe execution looks alarming in isolation. In context, if that host has run the same certutil command via the same service account at 3AM every Sunday for six months, it is probably a legitimate certificate renewal. The process is the same. The context is everything.

Phase 3: Score Your Severity

Phase 4: Investigate and Contain

The investigation and containment phases run in parallel for active threats. You do not finish investigating before containing. As soon as you confirm malicious activity, you isolate the endpoint or revoke the credentials and continue building the picture from there. Waiting costs you lateral movement time.

What to look for in the process tree

• Office applications or browsers spawning scripting engines (PowerShell, cmd, wscript)
• Scripting engines making outbound network connections
• Unusual parent-child relationships — services that never spawn children suddenly spawning children
• Processes running from unusual locations (Downloads, Temp, AppData)

Phase 5: Document and Close

Documentation is not administrative overhead. It is what allows a different analyst to pick up this ticket six months later and understand what happened in three minutes instead of thirty. It is also what protects you if a closed alert turns out to be the early indicator of a breach that was not caught until later.

The 10 Most Common Triage Mistakes

• Starting the investigation before identifying all anchors
• Closing an alert as a false positive because it looks similar to previous false positives
• Skipping context-building and going straight to the process tree
• Assigning P3 when evidence actually supports P2 because escalating feels disruptive
• Not checking the time — alerts that look routine at 2PM look different at 2AM on a Saturday
• Investigating only the host or only the user, not both
• Closing without documenting the reason for the disposition
• Not checking for lateral movement after confirming an initial access indicator
• Dismissing an alert because the source IP passes reputation checks — credential attacks come from legitimate IPs
• Treating volume anomalies as less serious than signature-based detections