// THREAT DETECTION AND DATA PRIVACY TERM

Triage

In cybersecurity, triage is the initial process of quickly assessing new security incidents or alerts to determine their severity, impact, and urgency. This helps incident responders decide which issues need immediate attention and how to allocate resources effectively.

TECHNICAL DEFINITION

Triage in cybersecurity incident response refers to the rapid, initial assessment and classification of security alerts or incidents based on predefined criteria, including severity, potential impact, and resource requirements, to prioritize subsequent remediation actions and resource allocation.

BACKGROUND

Threat Intelligence Platform (TIP) is an emerging technology discipline that helps organizations aggregate, correlate, and analyze threat data from multiple sources in real time to support defensive actions. TIPs have evolved to address the growing amount of data generated by a variety of internal and external resources (such as system logs and threat intelligence feeds) and help security teams identify the threats that are relevant to their organization. By importing threat data from multiple sources and formats, correlating that data, and then exporting it into an organization’s existing security systems or ticketing systems, a TIP automates proactive threat management and mitigation. Modern threat intelligence platforms typically extend across many use-cases to encompass dark web monitoring, leaked credential monitoring, social media, and brand protection in addition to IOCs.

READ MORE ON WIKIPEDIA

SYNONYMS & ALIASES

  • Initial assessment
  • Prioritization
  • Incident classification
  • Severity ranking
  • First-pass analysis
  • Screening

USAGE NOTE

Triage is a critical first step in the incident response lifecycle, ensuring that high-impact threats are addressed before less critical ones.

DEVELOPERS

Organizations developing technology related to Triage.

  • Palo Alto Networks

    Offers Cortex XSOAR, a Security Orchestration, Automation, and Response (SOAR) platform, which is critically used for automating and orchestrating security incident triage, investigation, and response workflows. Their XDR platform also aids in threat triage.

  • CrowdStrike

    Provides the Falcon platform, an industry-leading endpoint detection and response (EDR) and extended detection and response (XDR) solution that helps security teams automatically detect, prioritize, and triage threats across endpoints, cloud workloads, and identities.

  • Splunk

    Known for its Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) platforms, Splunk Enterprise Security and Splunk SOAR enable security analysts to ingest, analyze, and triage security events and alerts effectively.

  • Mandiant (Google Cloud)

    A leading provider of incident response and threat intelligence services. Their expertise and technologies are centered around rapidly assessing, prioritizing, and triaging complex security incidents and advanced persistent threats.

  • Rapid7

    Offers InsightIDR, an extended detection and response (XDR) solution that unifies SIEM and EDR capabilities, enabling security teams to detect, investigate, and triage threats and vulnerabilities across their environment.

  • SentinelOne

    Develops the Singularity Platform, an AI-powered security solution that provides autonomous threat detection, prevention, and response across endpoints, cloud, and identity. It helps security operations centers automate the triage of alerts and incidents.

  • Microsoft Security

    Provides a comprehensive suite of security solutions, including Microsoft Defender XDR and Microsoft Sentinel (SIEM). These platforms offer integrated capabilities for automated alert correlation, prioritization, and incident triage across various Microsoft services and third-party sources.

  • Exabeam

    Specializes in security analytics and automated incident response, with a platform that leverages User and Entity Behavior Analytics (UEBA) and SIEM to help security teams identify, prioritize, and triage high-fidelity threats from a vast amount of security data.

RELATED TERMS IN INCIDENT RESPONSE