Anthropic-Cybersecurity-Skills/skills/performing-alert-triage-with-elastic-siem/references/standards.md

Standards and References - Alert Triage with Elastic SIEM

Elastic Common Schema (ECS)

ECS is a standardized field naming convention for Elasticsearch data. All Elastic Security detections and triage workflows rely on ECS compliance.

Key ECS Field Categories for Triage

Category	Fields	Usage
Base	@timestamp, message, tags	Event timing and classification
Agent	agent.name, agent.type	Data source identification
Host	host.name, host.ip, host.os	Affected system context
User	user.name, user.domain	Identity attribution
Process	process.name, process.pid, process.command_line	Execution context
Network	source.ip, destination.ip, destination.port	Network activity
File	file.name, file.hash.sha256, file.path	File-related events
Threat	threat.tactic.name, threat.technique.id	MITRE ATT&CK mapping

MITRE ATT&CK Integration

Elastic Security maps detection rules and alerts to MITRE ATT&CK tactics and techniques, providing a common taxonomy for triage prioritization.

NIST SP 800-61 Rev 2

Triage aligns with NIST incident handling phases:

• Detection and Analysis (triage is the core of this phase)
• Prioritization based on functional impact, information impact, and recoverability

SOC Maturity Model

Triage Capability Levels

Level	Capability
Level 1	Manual review of individual alerts
Level 2	Grouped alert triage with correlation
Level 3	AI-assisted triage with automated enrichment
Level 4	Automated classification with human oversight
Level 5	Fully autonomous triage with exception-based review