Anthropic-Cybersecurity-Skills/skills/performing-alert-triage-with-elastic-siem/references/workflows.md

# Workflows - Alert Triage with Elastic SIEM

## 5-Step Rapid Triage Framework

```
1. Alert Reception (30 seconds)
   - Review alert title, severity, risk score
   - Check MITRE ATT&CK mapping
   |
   v
2. Context Assessment (2 minutes)
   - Examine affected host and user
   - Check asset criticality
   - Review process tree for endpoint alerts
   |
   v
3. Intelligence Enrichment (2 minutes)
   - Check threat intelligence feeds
   - Query for related alerts (same source/user)
   - Search for known IOCs
   |
   v
4. Classification (1 minute)
   - True Positive / False Positive / Needs Investigation
   - Assign confidence level
   |
   v
5. Action (2 minutes)
   - Document findings in alert notes
   - Escalate or close with rationale
   - Create tuning task if false positive
```

## Alert Grouping Strategy

### Smart Grouping Criteria
- Time window: Group alerts within 15-minute windows
- Entity: Group by affected host or user
- Kill chain stage: Group by MITRE ATT&CK tactic
- Source: Group by originating IP or detection rule

### Group Triage Process
1. Sort alert groups by highest severity member
2. Triage group as single unit when correlated
3. Escalate entire group if attack chain detected
4. Close group if false positive pattern identified

## Shift-Based Triage Queue Management

| Queue Priority | Alert Criteria | Analyst Tier |
|---|---|---|
| Immediate | Critical severity, critical assets | Tier 2+ |
| High | High severity or multiple related alerts | Tier 1/2 |
| Standard | Medium severity, standard assets | Tier 1 |
| Low | Low/info severity, non-critical | Tier 1 (batch review) |