Alert

It's a notification generated by a security solution when a specific event or sequence of events occurs. It's what saves SOC analysts from manually reviewing by highlighting only suspicious, anomalous events

Simplest used approach to prioritize alerts

1. Filter the alerts
   Make sure you don't take the alert that other analysts have already reviewed, or that is already being investigated by one of your teammates. You should only take new, yet unseen and unresolved alerts.
2. Sort by severity
   Start with critical alerts, then high, medium, and finally low. This is because detection engineers design rules so that critical alerts are much more likely to be real, major threats and cause much more impact than medium or low ones.
3. Sort by time
   Start with the oldest alerts and end with the newest ones. The idea is that if both alerts are about two breaches, the hacker from the older breach is likely already dumping your data, while the "newcomer" has just started the discovery.

Alert Triage is a process to review chosen alerts.

Alerts