SOC Alert Triage
Rate five factors about the alert and get a documented priority (P1–P5), a disposition and escalate/declare-incident decision, recommended next steps and a ready-to-paste ticket note.
Runs entirely in your browser. Nothing you select or type is stored or sent anywhere.
2. Triage result
How the priority is decided
The headline priority (P1–P5) is read from the ITIL incident-management Impact × Urgency matrix — a recognised, published framework, not a number this tool invented:
| Impact by urgency | Urgency High | Urgency Medium | Urgency Low |
|---|---|---|---|
| Impact High | P1 | P2 | P3 |
| Impact Medium | P2 | P3 | P4 |
| Impact Low | P3 | P4 | P5 |
The two axes come from your factor ratings:
- Impact is the worse of asset criticality and data sensitivity — a conservative reading of the functional-impact and information-impact axes in NIST SP 800-61r2 §3.2.6.
- Urgency is the worse of exploitation evidence and scope / spread, but is held Low while you rate the alert a likely false positive — you validate before you rush.
The disposition and the escalate / declare-incident decision follow the NIST SP 800-61r2 life cycle: P1–P2 move from Detection & Analysis into Containment, Eradication & Recovery (declare an incident); P3 stays in Detection & Analysis (investigate); P4–P5 and likely-false-positive are monitored or closed as an event (NIST distinguishes an event from an incident).