← Security Alert Triage: Evidence, Scope, and Handoff
1. Turn the Alert into a Testable Claim
An Alert Is a Claim, Not an Incident Verify Telemetry Before You Trust Presence or Absence
2. Scope and Test Explanations
Scope Entities and Time with Stop Rules Test Competing Hypotheses and Counter-Evidence
3. Decide, Hand Off, and Improve
Set Disposition, Severity, and Containment Authority Write the Handoff and Close the Feedback Loop
1. Turn the Alert into a Testable Claim

Verify Telemetry Before You Trust Presence or Absence

Check provenance, clocks, collection, parsing, suppression, retention, and action status before interpreting the alert or a missing event.

In this lesson, you will learn to:

  • Trace an alert field back to its source and collection path.
  • Classify missing evidence as absent, uncollected, filtered, delayed, overwritten, or unknown.

Verify Telemetry Before You Trust Presence or Absence

Provides a fast data-quality audit and a method for distinguishing no activity from no visibility.

Audit the evidence path

For every decisive field, identify the producer, collection agent, transport, parser, schema mapping, storage, detection, and enrichment source. Record the event time and ingestion time. Confirm time zone, clock health, host or tenant identifier, provider, event type, and raw payload. A parser can place the wrong value in a normalized user or source field; enrichment can attach the current asset owner to a historical event; duplicate ingestion can inflate counts.

Check whether the data source was expected to cover the entity and period. Review sensor health, license or connector status, audit policy, filter configuration, sampling, rule suppression, retention, and recent changes. If the alert says an action was blocked, verify the control result and whether other paths remained. A prevention status describes that action, not the absence of compromise before or after it. Keep a copy of the source evidence or a durable reference according to retention policy so later rule or enrichment changes do not rewrite the case history.

Telemetry crosses a chain of failure pointsProducer, collector, transport, parser, storage, analytic, and enrichment must be healthy for an alert field to support a claim.FIELD GUIDETelemetry crosses a chain of failure pointsDECISION CUEEventproducerEnrichment and alertEventproducerCollectorTransportand parserStorage andruleEnrichmentand alertRESPONSE CHAIN
Telemetry crosses a chain of failure points — Producer, collector, transport, parser, storage, analytic, and enrichment must be healthy for an alert field to support a claim.

Treat missing data as a finding with categories

Use explicit missing-data categories. “Absent” means the source was healthy, configured to record the event, retained the period, and a bounded query found no match. “Not collected” means the source did not ingest that event class. “Filtered” means a rule intentionally excluded it. “Delayed” means the event may still arrive. “Overwritten” means retention ended. “Unknown” means health or scope cannot be established. Only the first category supports a limited negative finding.

Query with the native identifier and time range before concluding no record exists. Normalized fields can omit case, prefixes, nested JSON, IPv6 forms, or domain qualifiers. Expand time for known clock and ingestion uncertainty, not indefinitely. Compare a healthy peer event to confirm the expected table and parser. If a missing source is essential to severity, escalate the visibility gap along with the alert. Continue with alternative telemetry when available, but state that proxy, endpoint, identity, or network evidence answers a different question. Confidence should fall when critical evidence is unavailable.

No matching event has several possible meaningsHealthy absence is separated from uncollected, filtered, delayed, overwritten, and unknown evidence.FIELD GUIDENo matching event has several possible meaningsDECISION CUEHealthysource andbounded queryDelayed, expired, orunknownTRUST BOUNDARYHealthy source andbounded query •Supported absenceNot collected orfiltered • Delayed,expired, or unknownCOVERAGE BOUNDARY
No matching event has several possible meanings — Healthy absence is separated from uncollected, filtered, delayed, overwritten, and unknown evidence.

Resources

  • NIST Cybersecurity Framework 2.0 — Use the CSF outcomes to connect reliable detection, incident analysis, response, recovery, governance, and improvement across the organization.
← Previous: An Alert Is a Claim, Not an Incident Next: Scope Entities and Time with Stop Rules →