Triage

Triage is the initial assessment of a security alert or incident to determine its severity, scope, and required response urgency. Analysts evaluate whether an alert is a true positive, assign a severity rating, and route it to the appropriate responder or playbook.

Effective triage processes prevent high-severity incidents from being buried under alert volume and are a critical first step in reducing MTTD.