FREE COURSE / SELF-PACED LEARNING

Security Alert Triage: Evidence, Scope, and Handoff

Turn alerts into tested hypotheses, proportionate dispositions and useful responder handoffs in this free analyst course.

Read the first lesson Explore the curriculum

Read freely. Create an account to save your completed lessons.

Experience level
Intermediate
Curriculum
3 modules · 6 lessons
Estimated reading
18 min
Language
English

Reading estimates use lesson text and an allowance for diagrams. Reflection, exercises and optional linked resources take additional time. These are estimates, not measured completion times.

KNOW WHAT YOU’RE WORKING TOWARD

What you’ll learn

  • Translate an unfamiliar alert into a precise claim, required evidence, and initial safety checks.
  • Verify telemetry provenance and health before using absence or presence as investigative proof.
  • Scope affected entities and time with explicit pivots, stop rules, and competing hypotheses.
  • Set confidence, impact, urgency, disposition, and handoff actions independently and reproducibly.

Is this the right course for you?

Who it’s for

SOC learners and analysts developing a repeatable alert-triage method.

Scope and boundaries

Alert reasoning, evidence scope and handoff. It does not replace local escalation, containment or evidence-retention procedures.

How you’ll learn

Self-paced reading with explanatory diagrams and linked resources. Reflection and optional resource study take additional time.

Before you begin

  • Basic security telemetry familiarity — Learners should recognize common security data such as authentication, endpoint, network, email, and cloud events. Experience with a particular SIEM or EDR product is not required.

About this course

Security alerts arrive as product-specific summaries, but analysts must decide what actually happened, who or what is affected, and whether response authority should be engaged. This course teaches new and developing SOC analysts a vendor-neutral triage workflow: normalize an alert into an evidence claim, verify telemetry health, scope entities and time, test competing explanations, separate confidence from impact and urgency, select a disposition, and create a concise handoff. It aligns daily triage with current NIST incident-response guidance while preserving the boundary between an alert, a cybersecurity event, and a confirmed incident. Completion means the learner can work an unfamiliar alert methodically, avoid uncontrolled pivoting, recommend authorized action, and feed verified outcomes back into detections and data quality.

FOLLOW THE LEARNING PATH

Course curriculum

MODULE 1

1. Turn the Alert into a Testable Claim

Normalize product output into observable facts and establish whether the telemetry can support the investigation before expanding it.

  1. An Alert Is a Claim, Not an IncidentRead detection output as a proposition about observed data, then define what would confirm, weaken, or reclassify it.3 min reading
  2. Verify Telemetry Before You Trust Presence or AbsenceCheck provenance, clocks, collection, parsing, suppression, retention, and action status before interpreting the alert or a missing event.3 min reading

MODULE 2

2. Scope and Test Explanations

Expand through explicit entity-time relationships, stop at defensible boundaries, and compare explanations using predicted and disconfirming evidence.

  1. Scope Entities and Time with Stop RulesMove from an anchor alert to affected accounts, devices, processes, destinations, and resources while recording why every pivot belongs.3 min reading
  2. Test Competing Hypotheses and Counter-EvidenceCompare malicious, expected, policy, and telemetry explanations through predictions rather than collecting only evidence that supports the alert.3 min reading

MODULE 3

3. Decide, Hand Off, and Improve

Set a disposition and response priority from calibrated confidence and impact, then produce a concise handoff and durable feedback to detections and telemetry.

  1. Set Disposition, Severity, and Containment AuthorityMake five distinct decisions: what the alert represents, how strongly evidence supports it, what could be affected, how fast to act, and who may act.3 min reading
  2. Write the Handoff and Close the Feedback LoopProduce a compact case responders can continue, then turn verified outcomes into data, detection, playbook, and training improvements.3 min reading

BUILD ON THE RIGHT FOUNDATION

These courses address different scopes. Choose the foundation or follow-on that fits your next question.

Sources and editorial review

Reviewed by Threat Intelligence Lab

Sources linked in the lessons provide context and further reading. Check the original documentation for current platform behavior and requirements.

Selected references are shown here; the lessons contain the full reading lists.

About this learning content: Courses, lessons, assessments, explanations and illustrations may be created with the help of artificial intelligence. We review and check the material and do our best to avoid incorrect or outdated information, but mistakes, omissions or ambiguous questions may remain. Please verify information before relying on it for professional, security, legal or operational decisions. Read the full notice or report an issue.