# Elastic SIEM Alert Triage Template

## Alert Information

| Field | Value |
|---|---|
| Alert ID | |
| Rule Name | |
| Severity | |
| Risk Score | |
| Timestamp | |
| MITRE Tactic | |
| MITRE Technique | |

## Affected Entities

| Entity | Value | Criticality |
|---|---|---|
| Host | | |
| User | | |
| Source IP | | |
| Destination IP | | |

## Triage Assessment

### Initial Review
- [ ] Reviewed alert details and severity
- [ ] Checked MITRE ATT&CK mapping
- [ ] Examined process tree (endpoint alerts)

### Context Gathered
- [ ] Queried related host activity
- [ ] Checked user activity history
- [ ] Searched for related alerts from same source
- [ ] Reviewed network connections

### Threat Intelligence
- [ ] Checked IPs against TI feeds
- [ ] Checked file hashes against TI feeds
- [ ] Checked domains against TI feeds

## Classification

| Classification | Selected |
|---|---|
| True Positive | [ ] |
| False Positive | [ ] |
| Benign True Positive | [ ] |
| Needs Investigation | [ ] |

## Findings

### Evidence Summary


### Analyst Notes


### Recommended Actions


## Escalation

| Field | Value |
|---|---|
| Escalated | Yes / No |
| Escalated To | |
| Incident ID | |
| Reason | |
