triaging-security-incident

Automate security incident triage by classifying alerts, assigning severity based on business impact, and routing incidents to response teams using the NIST SP 800-61r3 and SANS PICERL frameworks to determine scope and response actions quickly.

The SANS PICERL framework structures incident response into Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned phases. This Skill uses it alongside NIST SP 800-61r3 to automate the initial identification, prioritization, and triage of security incidents.

Yes, security incident triage requires access to SIEM and EDR platforms, threat intelligence services, and asset inventories to collect and enrich alert data, identify patterns, and generate actionable triage reports.

Generate a structured triage report by passing a new alert to the triage process, which collects alert data, checks it against threat intelligence, assigns severity based on business impact, and documents actionable recommendations.

Yes, you can integrate threat intelligence services to enrich collected alert data, identify patterns for further analysis, and accurately prioritize security incidents based on their scope and business impact.