Set Disposition, Severity, and Containment Authority
Make five distinct decisions: what the alert represents, how strongly evidence supports it, what could be affected, how fast to act, and who may act.
In this lesson, you will learn to:
- Assign a disposition using defined evidence criteria.
- Recommend proportionate action while respecting delegated containment authority and business impact.
Set Disposition, Severity, and Containment Authority
Provides a decision framework for malicious, benign, policy, duplicate, and insufficient-evidence outcomes, with separate confidence, impact, urgency, and action authority.
Keep disposition, confidence, impact, and urgency separate
Disposition answers what the alert represents: confirmed malicious activity, suspicious unresolved activity, benign expected behavior, benign policy violation, duplicate, telemetry or rule error, or insufficient evidence. Confidence describes support for that classification. Impact describes privilege, asset criticality, data, persistence, and business consequence. Urgency describes how quickly delay can increase harm. Product severity is useful context but should not collapse these dimensions.
Use an evidence threshold defined by the team. A confirmed blocked exploit attempt against an unused service may be malicious with low realized impact. An uncertain session involving a highly privileged account and active data access may be urgent despite incomplete confidence. A duplicate alert can still belong to an open incident and should link to it rather than disappear. “False positive” should identify whether the logic matched benign behavior as designed, data was wrong, or the rule was implemented incorrectly; those causes require different fixes.
Choose reversible, authorized action at the evidence threshold
Containment can include account or session action, endpoint isolation, message removal, network blocking, cloud-policy change, or disabling automation. Each action has technical limits and business effects. Verify whether the analyst role is authorized to execute, recommend, or only notify. Prefer reversible and precise controls when evidence is incomplete: revoke one session rather than disable an entire service identity, block a specific destination rather than a shared provider, or isolate one endpoint after confirming operational impact.
Record action owner, approval, time, scope, expected effect, verification query, rollback, and evidence-preservation need. Containment changes the environment, so capture volatile or short-retention evidence in the order required by the playbook. If immediate action is justified, state the threshold: ongoing privileged access, destructive behavior, rapid spread, or critical asset exposure. Escalation is not failure to finish triage; it is a controlled transfer when authority, expertise, impact, or coordination exceeds the current role.
Resources
- CISA incident and vulnerability playbooks overview — Use the official overview to understand standardized identification, coordination, remediation, recovery, mitigation tracking, and communication practices.