Incident triage
Incident triage is the initial assessment of a security report or detection to decide its validity, urgency, and appropriate owner or next action.
Decide what needs attention now
Triage turns an incoming report into a response decision. The analyst checks what was observed, which people or systems may be affected, whether activity is continuing, and who can investigate or act. NIST recommends risk-based prioritization rather than handling incidents simply in arrival order.
The initial assessment can remain uncertain. A message claiming stolen data may warrant urgent investigation without establishing that theft occurred. The extortion-claim article explains how to preserve that distinction in the first report.
One alert may be part of a larger incident
Microsoft Defender groups related alerts into incidents so analysts can investigate connected activity. That grouping provides context; it does not remove the need to evaluate the underlying evidence or adjust the priority.
A triage decision should leave the next person with a usable handoff: the reported behavior, affected identity or device, relevant time, immediate concern, and assigned follow-up. SOC scenario visibility shows why routing a report and having someone acknowledge it are different outcomes.
Triage is not a complete forensic investigation, and containment need not wait for every question to be answered. Use the response process to decide when the evidence warrants action. As new facts arrive, revisit the classification and priority rather than defending the first label.