Anthropic-Cybersecurity-Skills/skills/performing-alert-triage-with-elastic-siem/assets/template.md

Elastic SIEM Alert Triage Template

Alert Information

Field	Value
Alert ID
Rule Name
Severity
Risk Score
Timestamp
MITRE Tactic
MITRE Technique

Affected Entities

Entity	Value	Criticality
Host
User
Source IP
Destination IP

Triage Assessment

Initial Review

• Reviewed alert details and severity
• Checked MITRE ATT&CK mapping
• Examined process tree (endpoint alerts)

Context Gathered

• Queried related host activity
• Checked user activity history
• Searched for related alerts from same source
• Reviewed network connections

Threat Intelligence

• Checked IPs against TI feeds
• Checked file hashes against TI feeds
• Checked domains against TI feeds

Classification

Classification	Selected
True Positive	[ ]
False Positive	[ ]
Benign True Positive	[ ]
Needs Investigation	[ ]

Findings

Evidence Summary

Analyst Notes

Recommended Actions

Escalation

Field	Value
Escalated	Yes / No
Escalated To
Incident ID
Reason